~/f/scap-security-guide/RPMS.2017 ~/f/scap-security-guide ~/f/scap-security-guide RPMS.2017/scap-security-guide-0.1.64-0.0.noarch.rpm RPMS/scap-security-guide-0.1.64-0.0.noarch.rpm differ: byte 226, line 1 Comparing scap-security-guide-0.1.64-0.0.noarch.rpm to scap-security-guide-0.1.64-0.0.noarch.rpm comparing the rpm tags of scap-security-guide --- old-rpm-tags +++ new-rpm-tags @@ -220,9 +220,9 @@ -/usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html 48fa994361bf6b20b4d7f6f82f063369c387b058eebf312683397c68a6db4162 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html eaff4b08c8e45fe3f9f1be676338dfe254907e52759aaf5d30dd96d1d586d31c 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html ce716345c4d533698db5a1efd77d2dd38281e8300dfa95c9ae4b31f83761266b 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html 080636882452630798ed3dde91f5c01a53ff716fff1388c7b94c1802c6be4f45 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html 7b5a732b4a7d5729ac3904f8deaef4c798ab6d95fc3c6d5ab9bbac66f9cfa04d 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html c67db4c842323fd1297d7b5b79156f4cb01a83135c89f5206cec367dfa2e1bfc 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html 64bef5b04267ed57afdbda1b0849fa6d0a262ecb81b5f94851fe717a2b0ff656 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html 87f121bd2f3671e294d003415cccf1e4c4ccf5418f8f1695800a71809fb9d0ee 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html 65ef2c1c96cd0e08a654b2935b9d24596493ea4a61f2d112ac026e0782878a13 2 +/usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html ab71c4540f492a3da1c256d52e29837fbf5b50feff1eccb164c4c28bf0cc6092 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html 139cf41b89dfd783994b6206695bd4beb403a7608395892f3a0d98c7c5e46bf4 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html 26ea38c7c9d01d07832624fcd6efeed513851100116f2b453ddd1e0c38943dee 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html af692026a6bf5193b3575f16d621561e17c58d920b37c0db523cf33f8921a8c5 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html 95624e20cf08677309d94fdb2ce6929ec649f18cf48b773820b5e8bcdd217d01 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html 4298b457b79806073451ae2b890935ad418c236712b7af6a7d1edba42cbd4931 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html cb5cddbef7c25f31bda374250312e6e7a72d31b32a2cd6d21302ab0c4c6ca41d 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html ef1313d6618405da9d5a927f989d9e20b1967910db755230bd50997d57ccbee3 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html f4a6ba549d6d6907bbf8f024a19076541afb096c40f853de7aca84b9495f19f4 2 @@ -230,11 +230,11 @@ -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html fbfa2abe45a911c9533f1b809820f8bd97d8ce15591683c9e0e5c2511aaf5046 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html 73b7ea3ff9721f5e19e49fb824beacad53bef5cdd575dd886d42260377839118 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html d36ba39963288286dae959feb009e00784e507e4579d37ab895884e920f920a6 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html a7dd5c1fc9033fc9ae096a5fa50eff827535a2a6f650b3d661b24e7a66197ba2 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html 84b3a1541fdbfb64128b421d50d0fa8ba1cbc927fc1f3a6fe996d394f5b6a5f0 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html a991241db7917be03fa13b18582eda5780ba152f8062a994230122c60513da57 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html 3fd927b05600cc8c12e22c6839698b809be7dce1d363b84072fe8deb661ecee5 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html a62c97647ae02dbd0b039c090f1cc7c66d1858dec9281e704ce5a6742aecf4e1 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html f38d00e03853baf0966fcab719935bf34b57e1f60be6a4f484f84d4b98e651e4 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html a99fa2525cb1f34fd84bf64a56d4a2a6fcf26bac4dee12f5d32a129ff32adc3f 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html abcd1b67c13af6b903d65fcee8f440a6275e7eccff1614ed4d74f33d14738feb 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html 18bbc2a1a64a4a5f659785a1665fd1b0f26a62180a133a1bc90f3e3fc174813a 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html 390880ae013957a3a1475d234807190f309f6dc1d3752c39c6453a6607bfea81 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html fb615d43a33ff77b2b5e1d8598a4d513aa9d2df95725aa948b0de174730828b9 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html ead10f9b2c6d673703b496d011e6febe73ca943bde18e3a4b4aaa63ef32668c5 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html 366f2d79f2be51d90364d36f961c5994b7ed492bc8b5f9cecb74124179cc9b32 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html 6931b2c1a443fa7779a38002512e24dbb65fb61b81fad83a43034e8241ce0212 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html 405cd9d5a6c824aa7c5cb26da3198f0bf1e46abd77305cc346a27655c3fbf73e 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html b950f630fb9bea34a34fa27980539844f41ce16c579066531a91a4ec34f62cf9 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html 688a63b0a8b2bdb8a3476d1ffd0e6660fc665bb51d5b9e57dffb0af06cd5b1d6 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html 136677aeae3d87c2ddfb5c9244c0e5bc424d745fdc9f5e1453741cd1c7b57987 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html 81ea38cc4fb0682b433bcc6091464fa343a5479fc528ca79ee8ee54ccbaa44b2 2 @@ -242,4 +242,4 @@ -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html cf1cb729bdfb7e6d6ad3ee1bec768b7767199768f4df316bf428248462dc5cfc 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html 9e9eaefe114535cbb4ef05c6f9e7211ae93494954a47ba89c959a750f49fffa4 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html 6c5b80b2856f68e6fc1e0d026b77eaada17654a57e177b78e804ff6e7d1837d7 2 -/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html bead8b87d762f4178f89c14b36700af0c7a301ddc7b317af07ca80a420276e1e 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html 3fbe8dc505328400a193bb38d41acf02ae28fc6ad3bcad495c09f0ab469763a6 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html ffd59bbd6fdf5f51c5811bc67a4af327b733609b97fce7758b9cb94855b532ea 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html 955a4610cfbf87917baeb62a28f37338fd488acce3749d8bb05122650fa7489e 2 +/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html bc2e6e57373527199307c5936f6014592e988d4bf64161e4e4e855b850951919 2 @@ -313,3 +313,3 @@ -/usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml 8ca8c12ecbe0ad107add53264ec6c76226600806f3b9fd3194661700ef65871c 0 -/usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml ee022b48f1efdf4b504780235efed25389a70f55681f6130e33e97a3d5890830 0 -/usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml eec97b83fecc303ef293dba901dc80e9a54243d92d0d1c51ae0d4ff1b141aaca 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml 0b5d6ca61f77675b2597f76d951d7bc9d51b65f221947c71b14485a911691c5e 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml 38f1f9835fa4f7aefddbe4e42bec0a1001b125f944b600d1da29225cbefbd00d 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml 3198c63cdf898b9a5fc54fa5b5bf885ec0d52d09be4df3a71e2dcf27a40252b4 0 @@ -317 +317 @@ -/usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml 37367ff0f887269ad0842fae91e748f5f26744d2d8e351de40e086dc838570d0 0 +/usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml 8b842f2eca357f2eb2ff6aba6a46e994d34bfb3dadf099b915c62d8440b170c6 0 @@ -320,3 +320,3 @@ -/usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml ff401a5cf70f029c0c89ca2906fb9de2e7eb51ac69548556060af0d76cca1279 0 -/usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml 9b4fa333edc7114b8a8688c50577e008b41d1f0e219d43ee43b1b74518b29cec 0 -/usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml 8672ba1ad8c9fcf82d545188e3a58ded491132fbbb6d4e3e034346aaa0101725 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml d974ad66ce66f04d7d98af6414b9dc78bdfbc6c2636f98ade321d45bf2291741 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml 4a85283120dc59105a838439ba77e91bb5afafa2dd518e51dc3c4b3b4337c7ee 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml 13a03793c68a2d1fa46375747d458174c50401e0ac9cf287b3110226abca582b 0 @@ -324 +324 @@ -/usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml a20dee9feabeb3223d8a85084d2a3326fe15da3fdd4d50c4ac98b929cdf654df 0 +/usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml 80e4679fb53d2d889b73083d549b1d443e3bc5ba18e9e7fccc3c70674bd238bf 0 @@ -327,3 +327,3 @@ -/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml 315a538a93958aff75ad8a327331de0b7f93d22acb5059a485598e650fe507ab 0 -/usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml 78511903dfa057ca79bc8403463c114e0c30c7abd75e9406525e7ba92af36227 0 -/usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml a83b1c612d62765433094a0b727cd3ba8d4baab3c56208b296b08a71ea1aed36 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml cb01d13cb7a3df18b62c9c191fb31fd44c6515e5bdf382c11aa27e3322d8b6a0 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml 4db975386f987aeb9fad5034a6793bc708d28985573ecd0e86f2eb41954bd3d4 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml 41c3ca016c18a0617340dcea143dba89783ee87652ee26dd0c26791a0720ad68 0 @@ -331 +331 @@ -/usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml 483dc45d6ce355eb3aa1035d1e38c841e52471de6cad6909343b436fa24a6ca0 0 +/usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml 2929ba1372e4a05d52177350ed9b4d15cb7ee6d09882124ecb441e9c169d43b9 0 comparing rpmtags comparing RELEASE comparing PROVIDES comparing scripts comparing filelist comparing file checksum creating rename script RPM file checksum differs. Extracting packages /usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-opensuse-guide-standard.html 2022-10-05 00:00:00.000000000 +0000 @@ -67,7 +67,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for openSUSE
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:opensuse:leap:42.1
  • cpe:/o:opensuse:leap:42.2
  • cpe:/o:opensuse:leap:42.3
  • cpe:/o:opensuse:leap:15.0

Revision History

Current version: 0.1.64

Table of Contents

  1. System Settings
    1. File Permissions and Masks

Checklist

Group   Guide to the Secure Configuration of openSUSE   Group contains 4 groups and 3 rules
Group   /usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_enhanced.html 2022-10-05 00:00:00.000000000 +0000 @@ -77,7 +77,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 61 groups and 162 rules
Group   @@ -122,14 +122,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -137,10 +130,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -398,14 +398,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -413,10 +406,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -996,19 +996,19 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91476-2

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6527,14 +6527,7 @@
 $ sudo zypper install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-91512-4

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog-gnutls"
@@ -6542,10 +6535,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -6564,14 +6564,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -6579,10 +6572,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6605,15 +6605,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91460-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6624,9 +6616,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 61 groups and 175 rules
Group   @@ -122,14 +122,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -137,10 +130,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -829,14 +829,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -844,10 +837,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1427,19 +1427,19 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91476-2

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7062,14 +7062,7 @@
 $ sudo zypper install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-91512-4

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog-gnutls"
@@ -7077,10 +7070,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -7099,14 +7099,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -7114,10 +7107,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -7140,15 +7140,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91460-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -7159,9 +7151,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 57 groups and 151 rules
Group   @@ -122,14 +122,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -137,10 +130,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -398,14 +398,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -413,10 +406,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -996,19 +996,19 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91476-2

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6002,14 +6002,7 @@
 $ sudo zypper install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-91512-4

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog-gnutls"
@@ -6017,10 +6010,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -6039,14 +6039,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -6054,10 +6047,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6080,15 +6080,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91460-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6099,9 +6091,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 27 groups and 35 rules
Group   @@ -244,19 +244,19 @@ $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91476-2

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -3825,14 +3825,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -3840,10 +3833,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -3866,15 +3866,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91460-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3885,9 +3877,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -4011,14 +4011,7 @@
 $ sudo zypper remove dhcp
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

Identifiers:  CCE-91453-1

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 2.2.5


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -4026,6 +4019,13 @@
 #	   system!
 
 zypper remove -y "dhcp"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -4074,14 +4074,7 @@
 its design prevents it from being effectively contained by SELinux.  Postfix
 should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

Identifiers:  CCE-91463-0

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -4095,6 +4088,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -4144,14 +4144,7 @@
 $ sudo zypper remove xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

Identifiers:  CCE-91480-4

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, 2.1.1


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove xinetd
@@ -4165,6 +4158,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
+
+class remove_xinetd {
+  package { 'xinetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure xinetd is removed
   package:
     name: xinetd
@@ -4200,14 +4200,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 12 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 100 groups and 256 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -580,14 +580,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -595,10 +588,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -35121,14 +35121,7 @@
                                 Ensure the audit Subsystem is Installed
                                   [ref]
The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

Identifiers:  CCE-83023-2

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-7(a), AU-7(b), AU-8(b), AU-12.1(iv), AU-12(3), AU-12(c), CM-5(1), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SLES-12-020000, 4.1.1.1, SV-217190r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit"
@@ -35136,10 +35129,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -35177,15 +35177,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-83024-0

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-3, AU-3(1), AU-3(1).1(ii), AU-3.1, AU-6(4), AU-6(4).1, AU-7(1), AU-7(1).1, AU-7(a), AU-14(1), AU-14(1).1, CM-6(b), CM-6.1(iv), MA-4(1)(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-12-020010, 4.1.1.2, SV-217191r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-3, AU-3(1), AU-3(1).1(ii), AU-3.1, AU-6(4), AU-6(4).1, AU-7(1), AU-7(1).1, AU-7(a), AU-14(1), AU-14(1).1, CM-6(b), CM-6.1(iv), MA-4(1)(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-12-020010, 4.1.1.2, SV-217191r603262_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -35196,9 +35188,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -35549,14 +35549,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-83225-3

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-12-010600, 1.6.1.1, SV-217158r646719_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -35564,10 +35557,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -35913,14 +35913,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 12 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 89 groups and 193 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -530,14 +530,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -545,10 +538,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -4272,14 +4272,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-83225-3

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-12-010600, 1.6.1.1, SV-217158r646719_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -4287,10 +4280,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -4636,14 +4636,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -4651,10 +4644,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -4677,15 +4677,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91460-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -4696,9 +4688,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -4793,15 +4793,7 @@
 The iptables service can be enabled with the following command:
 
$ sudo systemctl enable iptables.service
Rationale:
The iptables service provides the system's host-based firewalling capability for IPv4 and ICMP.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_iptables_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 6, 8, 9, APO01.06, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, 3.5.1.1


Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
-
-class enable_iptables {
-  service {'iptables':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 12 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. DHCP
    3. DNS Server
    4. FTP Server
    5. Web Server
    6. IMAP and POP3 Server
    7. LDAP
    8. Mail Server Software
    9. NFS and RPC
    10. Network Time Protocol
    11. Obsolete Services
    12. Proxy Server
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 83 groups and 190 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -530,14 +530,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -545,10 +538,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -4272,14 +4272,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-83225-3

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-12-010600, 1.6.1.1, SV-217158r646719_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -4287,10 +4280,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -4636,14 +4636,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -4651,10 +4644,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -4677,15 +4677,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91460-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -4696,9 +4688,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -4793,15 +4793,7 @@
 The iptables service can be enabled with the following command:
 
$ sudo systemctl enable iptables.service
Rationale:
The iptables service provides the system's host-based firewalling capability for IPv4 and ICMP.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_iptables_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 6, 8, 9, APO01.06, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, 3.5.1.1


Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
-
-class enable_iptables {
-  service {'iptables':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 12 Benchmark Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 98 groups and 255 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -580,14 +580,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91491-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -595,10 +588,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -35121,14 +35121,7 @@
                                 Ensure the audit Subsystem is Installed
                                   [ref]
The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

Identifiers:  CCE-83023-2

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-7(a), AU-7(b), AU-8(b), AU-12.1(iv), AU-12(3), AU-12(c), CM-5(1), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SLES-12-020000, 4.1.1.1, SV-217190r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit"
@@ -35136,10 +35129,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -35177,15 +35177,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-83024-0

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-3, AU-3(1), AU-3(1).1(ii), AU-3.1, AU-6(4), AU-6(4).1, AU-7(1), AU-7(1).1, AU-7(a), AU-14(1), AU-14(1).1, CM-6(b), CM-6.1(iv), MA-4(1)(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-12-020010, 4.1.1.2, SV-217191r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-3, AU-3(1), AU-3(1).1(ii), AU-3.1, AU-6(4), AU-6(4).1, AU-7(1), AU-7(1).1, AU-7(a), AU-14(1), AU-14(1).1, CM-6(b), CM-6.1(iv), MA-4(1)(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-12-020010, 4.1.1.2, SV-217191r603262_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -35196,9 +35188,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -35549,14 +35549,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-83225-3

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-12-010600, 1.6.1.1, SV-217158r646719_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -35564,10 +35557,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -35913,14 +35913,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91455-6

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for SUSE Linux Enterprise 12
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. File Permissions and Masks

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 4 groups and 3 rules
Group   /usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-sle12-guide-stig.html 2022-10-05 00:00:00.000000000 +0000 @@ -66,7 +66,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG for SUSE Linux Enterprise 12
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:12
  • cpe:/o:suse:linux_enterprise_desktop:12

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Base Services
    2. FTP Server
    3. Mail Server Software
    4. NFS and RPC
    5. Network Time Protocol
    6. Obsolete Services
    7. SSH Server
    8. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 12   Group contains 83 groups and 237 rules
Group   @@ -111,14 +111,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83067-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-12-010500, 1.3.1, SV-217148r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -126,10 +119,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -6839,19 +6839,19 @@
 reauthenticates. No other activity aside from reauthentication must
 unlock the system.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_vlock_installed
Identifiers and References

Identifiers:  CCE-83009-1

References:  - CCI-000056, CCI-000058, CCI-000060, AC-11(a), AC-11(b), AC-11(1), SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011, SLES-12-010070, SV-217108r603262_rule



Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "kbd"
+


+[[packages]]
+name = "kbd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_kbd
 
 class install_kbd {
   package { 'kbd':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "kbd"
-


-[[packages]]
-name = "kbd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure kbd is installed
   package:
     name: kbd
@@ -50981,14 +50981,7 @@
                                 Ensure the default plugins for the audit dispatcher are Installed
                                   [ref]
The audit-audispd-plugins package should be installed.
Rationale:
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed
Identifiers and References

Identifiers:  CCE-83033-1

References:  - CCI-001851, AU-4(1), SRG-OS-000342-GPOS-00133, SLES-12-020070, SV-217197r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit-audispd-plugins
-
-class install_audit-audispd-plugins {
-  package { 'audit-audispd-plugins':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001851, AU-4(1), SRG-OS-000342-GPOS-00133, SLES-12-020070, SV-217197r603262_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit-audispd-plugins"
@@ -50996,10 +50989,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit-audispd-plugins"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit-audispd-plugins
+
+class install_audit-audispd-plugins {
+  package { 'audit-audispd-plugins':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit-audispd-plugins is installed
   package:
     name: audit-audispd-plugins
@@ -51019,14 +51019,7 @@
                                 Ensure the audit Subsystem is Installed
                                   [ref]
The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

Identifiers:  CCE-83023-2

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-7(a), AU-7(b), AU-8(b), AU-12.1(iv), AU-12(3), AU-12(c), CM-5(1), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SLES-12-020000, 4.1.1.1, SV-217190r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit"
@@ -51034,10 +51027,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -51075,15 +51075,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-83024-0

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-3, AU-3(1), AU-3(1).1(ii), AU-3.1, AU-6(4), AU-6(4).1, AU-7(1), AU-7(1).1, AU-7(a), AU-14(1), AU-14(1).1, CM-6(b), CM-6.1(iv), MA-4(1)(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-12-020010, 4.1.1.2, SV-217191r603262_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AU-3, AU-3(1), AU-3(1).1(ii), AU-3.1, AU-6(4), AU-6(4).1, AU-7(1), AU-7(1).1, AU-7(a), AU-14(1), AU-14(1).1, CM-6(b), CM-6.1(iv), MA-4(1)(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-12-020010, 4.1.1.2, SV-217191r603262_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -51094,9 +51086,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -51202,14 +51202,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-83225-3

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-12-010600, 1.6.1.1, SV-217158r646719_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -51217,10 +51210,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 61 groups and 169 rules
Group   @@ -122,14 +122,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -137,10 +130,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -398,14 +398,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91183-4

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -413,10 +406,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -996,19 +996,19 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91163-6

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -9202,14 +9202,7 @@
 $ sudo zypper install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-91199-0

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog-gnutls"
@@ -9217,10 +9210,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -9239,14 +9239,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -9254,10 +9247,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -9280,15 +9280,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91162-8

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -9299,9 +9291,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 61 groups and 182 rules
Group   @@ -122,14 +122,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -137,10 +130,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -824,14 +824,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91183-4

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -839,10 +832,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1422,19 +1422,19 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91163-6

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -9732,14 +9732,7 @@
 $ sudo zypper install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-91199-0

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog-gnutls"
@@ -9747,10 +9740,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -9769,14 +9769,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -9784,10 +9777,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -9810,15 +9810,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91162-8

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -9829,9 +9821,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 57 groups and 158 rules
Group   @@ -122,14 +122,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -137,10 +130,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -398,14 +398,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91183-4

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -413,10 +406,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -996,19 +996,19 @@
 $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91163-6

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -8665,14 +8665,7 @@
 $ sudo zypper install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-91199-0

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog-gnutls"
@@ -8680,10 +8673,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -8702,14 +8702,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -8717,10 +8710,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8743,15 +8743,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91162-8

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -8762,9 +8754,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 27 groups and 42 rules
Group   @@ -244,19 +244,19 @@ $ sudo zypper install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-91163-6

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "dnf-automatic"
+


+[[packages]]
+name = "dnf-automatic"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
 
 class install_dnf-automatic {
   package { 'dnf-automatic':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "dnf-automatic"
-


-[[packages]]
-name = "dnf-automatic"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6488,14 +6488,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -6503,10 +6496,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6529,15 +6529,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91162-8

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6548,9 +6540,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6674,14 +6674,7 @@
 $ sudo zypper remove dhcp
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

Identifiers:  CCE-85759-9

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 2.2.5


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -6689,6 +6682,13 @@
 #	   system!
 
 zypper remove -y "dhcp"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -6737,14 +6737,7 @@
 its design prevents it from being effectively contained by SELinux.  Postfix
 should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

Identifiers:  CCE-85761-5

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6758,6 +6751,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6807,14 +6807,7 @@
 $ sudo zypper remove xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

Identifiers:  CCE-91436-6

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, 2.1.1


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove xinetd
@@ -6828,6 +6821,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
+
+class remove_xinetd {
+  package { 'xinetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure xinetd is removed
   package:
     name: xinetd
@@ -6863,14 +6863,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 15 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 109 groups and 275 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -575,14 +575,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91183-4

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -590,10 +583,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -35317,14 +35317,7 @@
                                 Ensure the audit Subsystem is Installed
                                   [ref]
The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

Identifiers:  CCE-85612-0

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SLES-15-030650, 4.1.1.1, SV-234964r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit"
@@ -35332,10 +35325,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -35373,15 +35373,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-85581-7

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -35392,9 +35384,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -35741,14 +35741,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-85765-6

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-15-010390, 1.7.1.1, SV-234848r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -35756,10 +35749,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -36513,14 +36513,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 15 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 97 groups and 212 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -525,14 +525,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91183-4

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -540,10 +533,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -4609,14 +4609,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-85765-6

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-15-010390, 1.7.1.1, SV-234848r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -4624,10 +4617,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -5381,14 +5381,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -5396,10 +5389,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -5422,15 +5422,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91162-8

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5441,9 +5433,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -5581,14 +5581,7 @@
 SUSE Linux Enterprise 15 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
 Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_firewalld_installed
Identifiers and References

Identifiers:  CCE-85698-9

References:  - CCI-002314, CM-7, CM-7.1(iii), CM-7(b), AC-17(1), FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, SLES-15-010220, 3.5.1.1, SV-234821r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
-
-class install_firewalld {
-  package { 'firewalld':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 15 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. AppArmor
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. DHCP
    3. DNS Server
    4. FTP Server
    5. Web Server
    6. IMAP and POP3 Server
    7. LDAP
    8. Mail Server Software
    9. NFS and RPC
    10. Network Time Protocol
    11. Obsolete Services
    12. Proxy Server
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 91 groups and 209 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -525,14 +525,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91183-4

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -540,10 +533,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -4609,14 +4609,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-85765-6

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-15-010390, 1.7.1.1, SV-234848r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -4624,10 +4617,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -5381,14 +5381,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -5396,10 +5389,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -5422,15 +5422,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91162-8

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5441,9 +5433,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -5581,14 +5581,7 @@
 SUSE Linux Enterprise 15 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
 Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_firewalld_installed
Identifiers and References

Identifiers:  CCE-85698-9

References:  - CCI-002314, CM-7, CM-7.1(iii), CM-7(b), AC-17(1), FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, SLES-15-010220, 3.5.1.1, SV-234821r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
-
-class install_firewalld {
-  package { 'firewalld':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS SUSE Linux Enterprise 15 Benchmark Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 107 groups and 274 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -130,10 +123,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -575,14 +575,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-91183-4

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "sudo"
@@ -590,10 +583,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -35317,14 +35317,7 @@
                                 Ensure the audit Subsystem is Installed
                                   [ref]
The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

Identifiers:  CCE-85612-0

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SLES-15-030650, 4.1.1.1, SV-234964r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit"
@@ -35332,10 +35325,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -35373,15 +35373,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-85581-7

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -35392,9 +35384,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -35741,14 +35741,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-85765-6

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-15-010390, 1.7.1.1, SV-234848r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -35756,10 +35749,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_apparmor"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
+
+class install_pam_apparmor {
+  package { 'pam_apparmor':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_apparmor is installed
   package:
     name: pam_apparmor
@@ -36513,14 +36513,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -73,7 +73,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 54 groups and 137 rules
Group   @@ -1374,15 +1374,7 @@ on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-91421-8

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1402,9 +1394,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
@@ -45081,15 +45081,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-85581-7

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -45100,9 +45092,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -45855,15 +45855,7 @@
 Additionally, automatically mounting filesystems permits easy introduction of
 unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

Identifiers:  CCE-83278-2

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227, SLES-15-010240, 1.1.23, SV-234823r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
-
-class disable_autofs {
-  service {'autofs':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -45883,9 +45875,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["autofs"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
+
+class disable_autofs {
+  service {'autofs':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service autofs
   block:
 
@@ -47067,15 +47067,7 @@
 on the target file system partition. Unless the system is used for kernel
 development or testing, there is little need to run the kdump service.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_kdump_disabled
Identifiers and References

Identifiers:  CCE-85638-5

References:  - 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000366, CCI-001665, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, FMT_SMF_EXT.1.1, SRG-OS-000269-GPOS-00103, SRG-OS-000480-GPOS-00227, SLES-15-040190, SV-235003r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include disable_kdump
-
-class disable_kdump {
-  service {'kdump':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -47095,9 +47087,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["kdump"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_kdump
+
+class disable_kdump {
+  service {'kdump':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service kdump
   block:
 
@@ -47182,15 +47182,7 @@
 
$ sudo systemctl enable cron.service
Rationale:
Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_cron_enabled
Identifiers and References

Identifiers:  CCE-91437-4

References:  - 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3, 5.1.1


Complexity:low
Disruption:low
Strategy:enable
include enable_cron
-
-class enable_cron {
-  service {'cron':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -47201,9 +47193,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["cron"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_cron
+
+class enable_cron {
+  service {'cron':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service cron
   block:
 
@@ -47338,14 +47338,7 @@
 $ sudo zypper remove xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

Identifiers:  CCE-91436-6

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, 2.1.1


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for SUSE Linux enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 48 groups and 111 rules
Group   @@ -392,14 +392,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -407,10 +400,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -5603,15 +5603,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

Identifiers:  CCE-85844-9

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5622,9 +5614,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["pcscd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
+
+class enable_pcscd {
+  service {'pcscd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service pcscd
   block:
 
@@ -39855,14 +39855,7 @@
                                 Ensure the default plugins for the audit dispatcher are Installed
                                   [ref]
The audit-audispd-plugins package should be installed.
Rationale:
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed
Identifiers and References

Identifiers:  CCE-85613-8

References:  - CCI-001851, SRG-OS-000342-GPOS-00133, SLES-15-030670, SV-234966r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit-audispd-plugins
-
-class install_audit-audispd-plugins {
-  package { 'audit-audispd-plugins':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001851, SRG-OS-000342-GPOS-00133, SLES-15-030670, SV-234966r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit-audispd-plugins"
@@ -39870,10 +39863,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit-audispd-plugins"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit-audispd-plugins
+
+class install_audit-audispd-plugins {
+  package { 'audit-audispd-plugins':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit-audispd-plugins is installed
   package:
     name: audit-audispd-plugins
@@ -39904,15 +39904,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-85581-7

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -39923,9 +39915,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -40780,19 +40780,19 @@
 to initiate a secure VPN connection protects information when it is
 transmitted over a wide area network.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_strongswan_installed
Identifiers and References

Identifiers:  CCE-85836-5

References:  - 12, 15, 3, 5, 8, APO13.01, DSS01.04, DSS05.02, DSS05.03, DSS05.04, CCI-001130, CCI-001131, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, SR 1.13, SR 2.6, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.4, A.11.2.6, A.13.1.1, A.13.2.1, A.14.1.3, A.15.1.1, A.15.2.1, A.6.2.1, A.6.2.2, CM-6(a), PR.AC-3, PR.MA-2, PR.PT-4, Req-4.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061



Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "strongswan"
+


+[[packages]]
+name = "strongswan"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_strongswan
 
 class install_strongswan {
   package { 'strongswan':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "strongswan"
-


-[[packages]]
-name = "strongswan"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure strongswan is installed
   package:
     name: strongswan
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-pcs-hardening.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePublic Cloud Hardening for SUSE Linux Enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_pcs-hardening

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Network Time Protocol
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 54 groups and 165 rules
Group   @@ -61408,15 +61408,7 @@ by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Identifiers and References

Identifiers:  CCE-85751-6

References:  - 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, CM-7, CM-7.1(iii), CM-7(b), AC-17(1), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-15-010220, 3.5.1.3, SV-234821r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
-
-class enable_firewalld {
-  service {'firewalld':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -61427,9 +61419,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["firewalld"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
+
+class enable_firewalld {
+  service {'firewalld':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service firewalld
   block:
 
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -68,7 +68,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for SUSE Linux Enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Web Server
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 45 groups and 119 rules
Group   @@ -26763,14 +26763,7 @@ Ensure the audit Subsystem is Installed   [ref]
The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

Identifiers:  CCE-85612-0

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SLES-15-030650, 4.1.1.1, SV-234964r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit"
@@ -26778,10 +26771,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -26819,15 +26819,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-85581-7

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -26838,9 +26830,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -27352,14 +27352,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo zypper install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-91161-0

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "rsyslog"
@@ -27367,10 +27360,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -27393,15 +27393,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-91162-8

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -27412,9 +27404,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -27552,14 +27552,7 @@
 SUSE Linux Enterprise 15 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
 Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_firewalld_installed
Identifiers and References

Identifiers:  CCE-85698-9

References:  - CCI-002314, CM-7, CM-7.1(iii), CM-7(b), AC-17(1), FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, SLES-15-010220, 3.5.1.1, SV-234821r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
-
-class install_firewalld {
-  package { 'firewalld':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "firewalld"
@@ -27567,10 +27560,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "firewalld"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
+
+class install_firewalld {
+  package { 'firewalld':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure firewalld is installed
   package:
     name: firewalld
@@ -31206,14 +31206,7 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include install_cron
-
-class install_cron {
-  package { 'cron':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sle15-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG for SUSE Linux Enterprise 15
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:suse:linux_enterprise_server:15
  • cpe:/o:suse:linux_enterprise_desktop:15

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. Base Services
    2. FTP Server
    3. Mail Server Software
    4. NFS and RPC
    5. Network Time Protocol
    6. Obsolete Services
    7. SSH Server
    8. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of SUSE Linux Enterprise 15   Group contains 83 groups and 237 rules
Group   @@ -111,14 +111,7 @@ 
 $ sudo zypper install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-83289-9

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, SLES-15-010420, 1.4.1, SV-234851r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "aide"
@@ -126,10 +119,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -7241,19 +7241,19 @@
 reauthenticates. No other activity aside from reauthentication must
 unlock the system.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_vlock_installed
Identifiers and References

Identifiers:  CCE-83268-3

References:  - CCI-000056, CCI-000058, CCI-000060, SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011, SLES-15-010110, SV-234811r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_kbd
+            CCI-000056, CCI-000058, CCI-000060, SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011, SLES-15-010110, SV-234811r622137_rule

Complexity:low
Disruption:low
Strategy:enable

+zypper install -y "kbd"
+


+[[packages]]
+name = "kbd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_kbd
 
 class install_kbd {
   package { 'kbd':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-zypper install -y "kbd"
-


-[[packages]]
-name = "kbd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure kbd is installed
   package:
     name: kbd
@@ -55304,14 +55304,7 @@
                                 Ensure the default plugins for the audit dispatcher are Installed
                                   [ref]
The audit-audispd-plugins package should be installed.
Rationale:
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed
Identifiers and References

Identifiers:  CCE-85613-8

References:  - CCI-001851, SRG-OS-000342-GPOS-00133, SLES-15-030670, SV-234966r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit-audispd-plugins
-
-class install_audit-audispd-plugins {
-  package { 'audit-audispd-plugins':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001851, SRG-OS-000342-GPOS-00133, SLES-15-030670, SV-234966r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit-audispd-plugins"
@@ -55319,10 +55312,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit-audispd-plugins"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit-audispd-plugins
+
+class install_audit-audispd-plugins {
+  package { 'audit-audispd-plugins':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit-audispd-plugins is installed
   package:
     name: audit-audispd-plugins
@@ -55341,14 +55341,7 @@
                                 Ensure the audit Subsystem is Installed
                                   [ref]
The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

Identifiers:  CCE-85612-0

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SLES-15-030650, 4.1.1.1, SV-234964r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "audit"
@@ -55356,10 +55349,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -55397,15 +55397,7 @@
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

Identifiers:  CCE-85581-7

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, SLES-15-030050, 4.1.1.2, SV-234904r622137_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -55416,9 +55408,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -55514,14 +55514,7 @@
 $ sudo zypper install pam_apparmor
Rationale:
Protection of system integrity using AppArmor depends on this package being installed.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_apparmor_installed
Identifiers and References

Identifiers:  CCE-85765-6

References:  - CCI-001764, CCI-001774, CCI-002165, CCI-002233, CCI-002235, AC-3(4), AC-6(8), AC-6(10), CM-7(5)(b), CM-7(2), SC-7(21), CM-6(a), SRG-OS-000312-GPOS-00122, SRG-OS-000312-GPOS-00123SRG-OS-000312-GPOS-00124, SRG-OS-000324-GPOS-00125, SRG-OS-000326-GPOS-00126, SRG-OS-000370-GPOS-00155, SRG-OS-000480-GPOS-00230, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, SLES-15-010390, 1.7.1.1, SV-234848r622137_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_apparmor
-
-class install_pam_apparmor {
-  package { 'pam_apparmor':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 zypper install -y "pam_apparmor"
@@ -55529,10 +55522,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -108,7 +108,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of openSUSE
       This guide presents a catalog of security-relevant
 configuration settings for openSUSE. It is a rendering of
@@ -151,14 +151,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -166,24 +161,24 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -191,9 +186,14 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -201,34 +201,34 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -2416,6 +2416,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -2424,11 +2429,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -2460,6 +2460,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -2468,11 +2473,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -5371,6 +5371,11 @@
             CCI-001851
             SRG-OS-000342-GPOS-00133
             Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
+            
+[[packages]]
+name = "audit-audispd-plugins"
+version = "*"
+
             include install_audit-audispd-plugins
 
 class install_audit-audispd-plugins {
@@ -5379,11 +5384,6 @@
   }
 }
 
-            
-[[packages]]
-name = "audit-audispd-plugins"
-version = "*"
-
             - name: Ensure audit-audispd-plugins is installed
   package:
     name: audit-audispd-plugins
@@ -5467,6 +5467,11 @@
             SRG-OS-000392-GPOS-00172
             SRG-OS-000475-GPOS-00220
/usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -108,7 +108,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of openSUSE
       This guide presents a catalog of security-relevant
 configuration settings for openSUSE. It is a rendering of
@@ -151,14 +151,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -166,24 +161,24 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -191,9 +186,14 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -201,34 +201,34 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -2416,6 +2416,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -2424,11 +2429,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -2460,6 +2460,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -2468,11 +2473,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -5371,6 +5371,11 @@
             CCI-001851
             SRG-OS-000342-GPOS-00133
             Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
+            
+[[packages]]
+name = "audit-audispd-plugins"
+version = "*"
+
             include install_audit-audispd-plugins
 
 class install_audit-audispd-plugins {
@@ -5379,11 +5384,6 @@
   }
 }
 
-            
-[[packages]]
-name = "audit-audispd-plugins"
-version = "*"
-
             - name: Ensure audit-audispd-plugins is installed
   package:
     name: audit-audispd-plugins
@@ -5467,6 +5467,11 @@
             SRG-OS-000392-GPOS-00172
             SRG-OS-000475-GPOS-00220
/usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -13,508 +13,508 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
+    
+      Disable storing core dump
       
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
+    
+      Kernel panic on oops
       
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Set Password Maximum Age
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Verify Root Has A Primary GID 0
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_root_gid_zero_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Verify User Who Owns /var/log/syslog File
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-file_owner_var_log_syslog_action:testaction:1
       
     
-    
-      Sign kernel modules with SHA-512
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchown
       
-        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1
       
     
-    
-      Enable checks on credential management
+    
+      Enable syslog-ng Service
       
-        ocil:ssg-kernel_config_debug_credentials_action:testaction:1
+        ocil:ssg-service_syslogng_enabled_action:testaction:1
       
     
-    
-      Ensure /var/log/audit Located On Separate Partition
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchmod
       
-        ocil:ssg-partition_for_var_log_audit_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1
       
     
-    
-      Disable storing core dump
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-coredump_disable_storage_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Configure auditd Disk Full Action when Disk Space Is Full
+    
+      Don't target root user in the sudoers file
       
-        ocil:ssg-auditd_data_disk_full_action_action:testaction:1
+        ocil:ssg-sudoers_no_root_target_action:testaction:1
       
     
-    
-      Ensure the Default Umask is Set Correctly in login.defs
+    
+      Enable SLUB debugging support
       
-        ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1
+        ocil:ssg-kernel_config_slub_debug_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Set SSH Idle Timeout Interval
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-sshd_set_idle_timeout_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup gshadow File
+    
+      Add nosuid Option to /dev/shm
       
-        ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1
+        ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1
       
     
-    
-      Enable Encrypted X11 Forwarding
+    
+      Add nodev Option to /dev/shm
       
-        ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1
+        ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1
       
     
-    
-      Ensure the Logon Failure Delay is Set Correctly in login.defs
+    
+      Disable SSH Support for Rhosts RSA Authentication
       
-        ocil:ssg-accounts_logon_fail_delay_action:testaction:1
+        ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup shadow File
+    
+      Verify Permissions on SSH Server Public *.pub Key Files
       
/usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-opensuse-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of openSUSE
   This guide presents a catalog of security-relevant
 configuration settings for openSUSE. It is a rendering of
@@ -43,14 +43,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
-      
-        
-      
-    
-    
+    
       
-        
+        
       
     
     
@@ -58,24 +53,24 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -83,9 +78,14 @@
         
       
     
-    
+    
       
-        
+        
+      
+    
+    
+      
+        
       
     
     
@@ -93,34 +93,34 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
   
@@ -2308,6 +2308,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+          
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
           include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -2316,11 +2321,6 @@
   }
 }
 
-          
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
           - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -2352,6 +2352,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+          
+[[packages]]
+name = "nss-tools"
+version = "*"
+
           include install_nss-tools
 
 class install_nss-tools {
@@ -2360,11 +2365,6 @@
   }
 }
 
-          
-[[packages]]
-name = "nss-tools"
-version = "*"
-
           - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -5263,6 +5263,11 @@
         CCI-001851
         SRG-OS-000342-GPOS-00133
         Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
+        
+[[packages]]
+name = "audit-audispd-plugins"
+version = "*"
+
         include install_audit-audispd-plugins
 
 class install_audit-audispd-plugins {
@@ -5271,11 +5276,6 @@
   }
 }
 
-        
-[[packages]]
-name = "audit-audispd-plugins"
-version = "*"
-
         - name: Ensure audit-audispd-plugins is installed
   package:
     name: audit-audispd-plugins
@@ -5359,6 +5359,11 @@
         SRG-OS-000392-GPOS-00172
         SRG-OS-000475-GPOS-00220
         The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
/usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -120,7 +120,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 12
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 12. It is a rendering of
@@ -163,50 +163,51 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -214,15 +215,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
         
@@ -230,50 +230,50 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -4665,14 +4665,6 @@
                   SV-217148r603262_rule
                   The AIDE package must be installed if it is to be available for integrity checking.
                   CCE-83067-9
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
                   # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -4687,6 +4679,14 @@
 name = "aide"
 version = "*"
 
+                  include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
/usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -122,7 +122,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 12
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 12. It is a rendering of
@@ -165,50 +165,51 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -216,15 +217,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
         
@@ -232,50 +232,50 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -4667,14 +4667,6 @@
                   SV-217148r603262_rule
                   The AIDE package must be installed if it is to be available for integrity checking.
                   CCE-83067-9
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
                   # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -4689,6 +4681,14 @@
 name = "aide"
 version = "*"
 
+                  include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
/usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -7,16 +7,10 @@
     2022-10-05T00:00:00
   
   
-    
-      Add nosuid Option to /var/log
-      
-        ocil:ssg-mount_option_var_log_nosuid_action:testaction:1
-      
-    
-    
-      Verify ownership of Message of the Day Banner
+    
+      Disable DCCP Support
       
-        ocil:ssg-file_owner_etc_motd_action:testaction:1
+        ocil:ssg-kernel_module_dccp_disabled_action:testaction:1
       
     
     
@@ -25,382 +19,377 @@
         ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1
       
     
-    
-      Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
-      
-        ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1
-      
-    
     
       Verify User Who Owns /var/log Directory
       
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      The Installed Operating System Is FIPS 140-2 Certified
+    
+      Ensure All Files Are Owned by a User
       
-        ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1
+        ocil:ssg-no_files_unowned_by_user_action:testaction:1
       
     
-    
-      Disable X Windows Startup By Setting Default Target
+    
+      Ensure auditd Collects Information on Kernel Module Unloading - delete_module
       
-        ocil:ssg-xwindows_runlevel_target_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1
       
     
-    
-      Set Interactive Session Timeout
+    
+      Only Authorized Local User Accounts Exist on Operating System
       
-        ocil:ssg-accounts_tmout_action:testaction:1
+        ocil:ssg-accounts_authorized_local_users_action:testaction:1
       
     
-    
-      Ensure invoking users password for privilege escalation when using sudo
+    
+      Modify the System Login Banner
       
-        ocil:ssg-sudoers_validate_passwd_action:testaction:1
+        ocil:ssg-banner_etc_issue_action:testaction:1
       
     
-    
-      Add noexec Option to /var/log
+    
+      Record Any Attempts to Run ssh-agent
       
-        ocil:ssg-mount_option_var_log_noexec_action:testaction:1
+        ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
+    
+      Disable storing core dump
       
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
+    
+      Ensure auditd Collects Information on Kernel Module Loading and Unloading
       
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1
       
     
-    
-      Verify Group Who Owns /etc/cron.allow file
+    
+      Kernel panic on oops
       
-        ocil:ssg-file_groupowner_cron_allow_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
+    
+      Enable the SuSEfirewall 2
       
-        ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1
+        ocil:ssg-service_SuSEfirewall2_enabled_action:testaction:1
       
     
-    
-      Uninstall setroubleshoot-plugins Package
+    
+      Add nosuid Option to /var/tmp
       
-        ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1
+        ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1
       
     
-    
-      Ensure rsyncd service is diabled
+    
+      Enable cron Service
       
-        ocil:ssg-service_rsyncd_disabled_action:testaction:1
+        ocil:ssg-service_crond_enabled_action:testaction:1
       
     
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Verify /boot/grub2/grub.cfg User Ownership
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-file_owner_grub2_cfg_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Configure a Sufficiently Large Partition for Audit Logs
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1
       
     
-    
-      Remove tftp Daemon
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-package_tftp_removed_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Add noexec Option to /var
+    
+      Verify User Who Owns /etc/cron.allow file
       
-        ocil:ssg-mount_option_var_noexec_action:testaction:1
+        ocil:ssg-file_owner_cron_allow_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Set Password Maximum Age
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Record Unsuccessful Access Attempts to Files - creat
+    
+      Modify the System Message of the Day Banner
       
-        ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1
+        ocil:ssg-banner_etc_motd_action:testaction:1
       
     
/usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle12-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of SUSE Linux Enterprise 12
   This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 12. It is a rendering of
@@ -43,50 +43,51 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -94,15 +95,14 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
-        
+        
       
     
     
@@ -110,50 +110,50 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
   
@@ -4545,14 +4545,6 @@
               SV-217148r603262_rule
               The AIDE package must be installed if it is to be available for integrity checking.
               CCE-83067-9
-              include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
               # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -4567,6 +4559,14 @@
 name = "aide"
 version = "*"
 
+              include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
+
/usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -128,7 +128,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 15
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 15. It is a rendering of
@@ -171,55 +171,56 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -227,71 +228,70 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -6486,14 +6486,6 @@
                   SV-234851r622137_rule
                   The AIDE package must be installed if it is to be available for integrity checking.
                   CCE-83289-9
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
/usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -130,7 +130,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of SUSE Linux Enterprise 15
       This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 15. It is a rendering of
@@ -173,55 +173,56 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -229,71 +230,70 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -6488,14 +6488,6 @@
                   SV-234851r622137_rule
                   The AIDE package must be installed if it is to be available for integrity checking.
                   CCE-83289-9
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
/usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -7,16 +7,10 @@
     2022-10-05T00:00:00
   
   
-    
-      Add nosuid Option to /var/log
-      
-        ocil:ssg-mount_option_var_log_nosuid_action:testaction:1
-      
-    
-    
-      Verify ownership of Message of the Day Banner
+    
+      Disable DCCP Support
       
-        ocil:ssg-file_owner_etc_motd_action:testaction:1
+        ocil:ssg-kernel_module_dccp_disabled_action:testaction:1
       
     
     
@@ -25,10 +19,10 @@
         ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1
       
     
-    
-      Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
+    
+      Ensure IPv6 is disabled through kernel boot parameter
       
-        ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1
+        ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1
       
     
     
@@ -37,406 +31,419 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      The Installed Operating System Is FIPS 140-2 Certified
+    
+      Ensure All Files Are Owned by a User
       
-        ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1
+        ocil:ssg-no_files_unowned_by_user_action:testaction:1
       
     
-    
-      Disable X Windows Startup By Setting Default Target
+    
+      Ensure auditd Collects Information on Kernel Module Unloading - delete_module
       
-        ocil:ssg-xwindows_runlevel_target_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1
       
     
-    
-      Verify that Interactive Boot is Disabled
+    
+      Only Authorized Local User Accounts Exist on Operating System
       
-        ocil:ssg-grub2_disable_interactive_boot_action:testaction:1
+        ocil:ssg-accounts_authorized_local_users_action:testaction:1
       
     
-    
-      Set Interactive Session Timeout
+    
+      Modify the System Login Banner
       
-        ocil:ssg-accounts_tmout_action:testaction:1
+        ocil:ssg-banner_etc_issue_action:testaction:1
       
     
-    
-      Ensure invoking users password for privilege escalation when using sudo
+    
+      Record Any Attempts to Run ssh-agent
       
-        ocil:ssg-sudoers_validate_passwd_action:testaction:1
+        ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1
       
     
-    
-      Add noexec Option to /var/log
+    
+      Disable storing core dump
       
-        ocil:ssg-mount_option_var_log_noexec_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
+    
+      Ensure auditd Collects Information on Kernel Module Loading and Unloading
       
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
+    
+      Kernel panic on oops
       
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      All User Files and Directories In The Home Directory Must Have a Valid Owner
+    
+      Configure System Cryptography Policy
       
-        ocil:ssg-accounts_users_home_files_ownership_action:testaction:1
+        ocil:ssg-configure_crypto_policy_action:testaction:1
       
     
-    
-      Verify Group Who Owns /etc/cron.allow file
+    
+      Add nosuid Option to /var/tmp
       
-        ocil:ssg-file_groupowner_cron_allow_action:testaction:1
+        ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
+    
+      Enable cron Service
       
-        ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1
+        ocil:ssg-service_crond_enabled_action:testaction:1
       
     
-    
-      Ensure IPv6 is disabled through kernel boot parameter
+    
+      Verify /boot/grub2/grub.cfg User Ownership
       
-        ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1
+        ocil:ssg-file_owner_grub2_cfg_action:testaction:1
       
     
-    
-      Uninstall setroubleshoot-plugins Package
+    
+      Configure a Sufficiently Large Partition for Audit Logs
       
-        ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1
+        ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1
       
     
-    
-      Ensure rsyncd service is diabled
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-service_rsyncd_disabled_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Verify User Who Owns /etc/cron.allow file
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-file_owner_cron_allow_action:testaction:1
       
     
-    
-      Remove tftp Daemon
+    
+      Set Password Maximum Age
       
-        ocil:ssg-package_tftp_removed_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Modify the System Message of the Day Banner
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-banner_etc_motd_action:testaction:1
/usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-sle15-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of SUSE Linux Enterprise 15
   This guide presents a catalog of security-relevant
 configuration settings for SUSE Linux Enterprise 15. It is a rendering of
@@ -43,55 +43,56 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -99,71 +100,70 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
-        
+    
+      
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
   
@@ -6358,14 +6358,6 @@
               SV-234851r622137_rule
               The AIDE package must be installed if it is to be available for integrity checking.
               CCE-83289-9
-              include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
RPMS.2017/scap-security-guide-debian-0.1.64-0.0.noarch.rpm RPMS/scap-security-guide-debian-0.1.64-0.0.noarch.rpm differ: byte 225, line 1
Comparing scap-security-guide-debian-0.1.64-0.0.noarch.rpm to scap-security-guide-debian-0.1.64-0.0.noarch.rpm
comparing the rpm tags of scap-security-guide-debian
--- old-rpm-tags
+++ new-rpm-tags
@@ -166,4 +166,4 @@
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html f2f0ee1b20610af930611cc7820c3aca93bee97a899f71b16239da5740be344c 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html 28a58c2c6145f80a1e29bb6417eb3d9b23126cfe423b8cbacd0af2c433b77f59 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html 12be280c424b8d97eddbda923edd63a8962de37be93afc0214fafea62021f2d0 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html 4cbb3c78c5d88b045a0ffe1043604c1e0f16ce0ea37b2677fbdc8c4fe2666d83 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html 7db8a408c4172bb60e026d3dfeea2449b5db8ef62f55b58704bd4cd6bec89a3f 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html 9f1d72220f3c363dece7ee21dde8f437b2c6f8fee3dc2a6041108fbf85006e1f 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html 64f9d9213dc5640cbbf2d24719b84a8fa97dfa277111ffe314b7f0fe2c0558f5 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html 287c4ef24ed1c6353ee61e995dd46c1625994a5c4a36b25815856dfeeaa46bad 2
@@ -171,5 +171,5 @@
-/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html 1122eee166c801c4051b2bce69048f94f83c2dbfa8907a158a2aa026aea80390 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html 3d8b07533c9a2a86f1cb976310619558234f9aaf4b6feec98949ab232ed163e9 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html 29f69ca513dbe29b7a9263b4287135cda2c2d600215c66290c3bc32bc33c1341 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html 5da420c56b24c9ee1a1c86642315519ccbd4f963cadb5a164258ac69fe9b4a38 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html 14d6bded2a6394d3fc1a98f3db09d537dd62c83f0cb57bb49c88a53d749ac516 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html 5ce6af31f3af2fd292c0f562b5c68b5fb4b83d15ec4a40d85c2f1724cd235d99 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html 7c996413b7a702d14736eda13b90f2acfb3c3a443815ef78f5eb947735cfaeb5 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html a7ab5f20e2807d8a7cac9ee5d069578cd17ad1db2378433c5d3d531671f7db95 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html 18903628106dadb976722c5df57009a27ea1805c07a3c55d292101e7e232a7c0 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html b60da02d4242a7ca88aad9f9b81fcb1dcc9edfd06d937454368b135d058efdb6 2
@@ -177,5 +177,5 @@
-/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html 7e3a5e69f710a2f32461e9766240ba21972b04ab07f59c18884da836f97ffbb0 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_average.html d934f47d3787b53f16398fe218f9cf2e48cdd8efa53a3f7821b7b2b6f9315650 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_high.html f8fe3c6e6c50dccd6e540d9fdfc86335a867d14f034095d11bd00f0d1a8a4851 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_minimal.html 138ad2b3da0c62d0cb15fe6069c5fe68d49b248952617647f85aa116f70fcebd 2
-/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_restrictive.html d2c4c1e44de61cef03d1e7bd921429118e6c6ec3594c6674e71617e8d310a411 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html fc4710fa51bef4edd109742578c067c8172ca970602eedbd28194a0a579b4315 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_average.html 2a12332813131fd76383d773cc63f9ee74edb0500ddff3b8c415e3950a362e9f 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_high.html 4f002d58720f8d70b28a5ee822e9e8564e1e90562ec362c3bd89d3eb824c957f 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_minimal.html 4090533f21614bf5ffd259293a9239aae89919a7176b0a5526380219bb8a36e7 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_restrictive.html 4a0fd1e37a264493ccb9fb229d21247ece722f744fdba4565f536a99acd93303 2
@@ -183 +183 @@
-/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-standard.html 5ab1eecbe88399e2cbba2806ded9402c8143cb043959116ec45173f39c53d89d 2
+/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-standard.html f4677b03989fe521f730f9051384f66050464c621f20b0f4ca59ee9d0c57e3de 2
@@ -226,3 +226,3 @@
-/usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml 8bd588ed4f17e57364fd6ee879cdc0d3e9a001bf90129cb0eac65dc5daf09277 0
-/usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml 3f04569e088ff43d5321d2202778f5eb36b013ac190d6c11fdda86fc9ed0f527 0
-/usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml 00e8656204d7ec94280f730d8f52059e9f1f7cf300732ee12a203c3aebab037d 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml 90b05ff2041e26fafd37849aab576b9bd26fd109a61d30d9bcb1424bcf873110 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml 5c3783ac67911644f3d68f5c2af7bf4868f5a7cedff4663e00ad41fb774393d1 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml 6f1bb59afa481eb05155e456de1d64c7d8ced764d9d1644fb833922dbc3bb18d 0
@@ -230 +230 @@
-/usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml d8e93a9b3208d49fb4d696def20b257b0575a0951b2e3036a5f2e325c5b6b067 0
+/usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml f313774a79d5bb9fcd7a3768f69705af6a1e59789b6defe6f2418aea45cdf60c 0
@@ -233,3 +233,3 @@
-/usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml aa49428bb8dddacc12f47c720c25706fcbef8fb59fa6fd6c95d57ed6ef203224 0
-/usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml 1c4c9a449145ce57a66eca09192e1aa0ca382c13c609236ac35e82f92fe5e6ca 0
-/usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml 5f044cbab98b2d18d81c1c236a1708a80fc601023349ea69a450fbfa25ef6434 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml 658d513f5a9fe21facc3164d9942da010b3bba60504d7e0ba73e88f91d826733 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml 92aac45fb8306ca58f01fec277c6b25f21ac8843c39ca326bbbe2b1ef9cc9c51 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml 26b84b4f4d306d15f950fd2c01dc210b7c52ae7222f11e123b37d06b8e0814e6 0
@@ -237 +237 @@
-/usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml 50a4011934744593cd4ffe535ed437a29a8f188e0b32d9617c857251a540bfc1 0
+/usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml a5c306253cfea2cc7859d2eb64ffbcefd02e8add933fbfaf3010f6f9bdcc2aeb 0
@@ -240,3 +240,3 @@
-/usr/share/xml/scap/ssg/content/ssg-debian9-ds-1.2.xml 5ef23cf934fbb91926261e75ad2afcb954730ea16bf209ace4e61c352a676e72 0
-/usr/share/xml/scap/ssg/content/ssg-debian9-ds.xml fa88192f0ded6f831972a6f91a042e74766eb60ea72c9c8100b7dca92316fa76 0
-/usr/share/xml/scap/ssg/content/ssg-debian9-ocil.xml 53a1a3cf54074ff931004b83be9ecf1bb088c560d6902cd3ea4b531a7a414394 0
+/usr/share/xml/scap/ssg/content/ssg-debian9-ds-1.2.xml 976795f2e8bd336cf66cc770e33d612173001e077831f96a4d6d2abc6142c37e 0
+/usr/share/xml/scap/ssg/content/ssg-debian9-ds.xml 0655e678e09f6b3eb64db039260820051562558bb114daa42ff36633e350eabe 0
+/usr/share/xml/scap/ssg/content/ssg-debian9-ocil.xml 2d2cfddb11cfaab5197cf8fdcd99c2303eeeb1d5301aa5362c69b882ad31fdff 0
@@ -244 +244 @@
-/usr/share/xml/scap/ssg/content/ssg-debian9-xccdf.xml 3e75edc1061a8d96ea31fc47cd4431bc4a3118c5eea14985c145598c9995844e 0
+/usr/share/xml/scap/ssg/content/ssg-debian9-xccdf.xml dc8ada35de8ae0abfd0351bb7314049da0b51536d5618ee023e696824cae31e2 0
comparing rpmtags
comparing RELEASE
comparing PROVIDES
comparing scripts
comparing filelist
comparing file checksum
creating rename script
RPM file checksum differs.
Extracting packages
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_average

CPE Platforms

  • cpe:/o:debian:debian_linux:10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 10   Group contains 20 groups and 45 rules
Group   @@ -483,17 +483,17 @@ 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -514,7 +514,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -522,9 +525,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -554,17 +554,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -585,7 +585,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -593,9 +596,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1480,14 +1480,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1495,6 +1488,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1512,14 +1512,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1527,6 +1520,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1540,14 +1540,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1555,6 +1548,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
+  package { 'ntpdate':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure ntpdate is removed
   package:
     name: ntpdate
@@ -1570,14 +1570,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 High (Enforced) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_high

CPE Platforms

  • cpe:/o:debian:debian_linux:10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 10   Group contains 23 groups and 50 rules
Group   @@ -354,17 +354,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -399,7 +399,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -407,9 +410,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -706,17 +706,17 @@
 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -737,7 +737,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -745,9 +748,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -777,17 +777,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -808,7 +808,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -816,9 +819,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1704,17 +1704,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1737,14 +1737,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1752,6 +1745,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1769,14 +1769,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal

CPE Platforms

  • cpe:/o:debian:debian_linux:10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services

Checklist

Group   Guide to the Secure Configuration of Debian 10   Group contains 11 groups and 24 rules
Group   @@ -237,17 +237,17 @@ 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -268,7 +268,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -276,9 +279,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -308,17 +308,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -339,7 +339,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -347,9 +350,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -932,14 +932,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -947,6 +940,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -964,14 +964,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -979,6 +972,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -994,14 +994,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd-ssl
 #	   from the system, and may remove any packages
 #	   that depend on telnetd-ssl. Execute this
@@ -1009,6 +1002,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd-ssl"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
+
+class remove_telnetd-ssl {
+  package { 'telnetd-ssl':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
   package:
     name: telnetd-ssl
@@ -1028,14 +1028,7 @@
                                   [ref]
The telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd_removed
Identifiers and References

References:  - BP28(R1), NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
-
-class remove_telnetd {
-  package { 'telnetd':
-    ensure => 'purged',
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Restrictive Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive

CPE Platforms

  • cpe:/o:debian:debian_linux:10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 10   Group contains 22 groups and 49 rules
Group   @@ -354,17 +354,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -399,7 +399,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -407,9 +410,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -685,17 +685,17 @@
 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -716,7 +716,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -724,9 +727,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -756,17 +756,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -787,7 +787,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -795,9 +798,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1683,17 +1683,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1716,14 +1716,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1731,6 +1724,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1748,14 +1748,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian10-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Debian 10
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:debian:debian_linux:10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 10   Group contains 19 groups and 44 rules
Group   @@ -230,17 +230,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -275,7 +275,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -283,9 +286,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -549,17 +549,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -580,7 +580,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -588,9 +591,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1462,17 +1462,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1495,7 +1495,10 @@
 The cron service can be enabled with the following command:
 
$ sudo systemctl enable cron.service
Rationale:
Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_cron_enabled
Identifiers and References

References:  - 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[customizations.services]
+enabled = ["cron"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_cron
 
 class enable_cron {
   service {'cron':
@@ -1503,9 +1506,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["cron"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service cron
   block:
 
@@ -1539,14 +1539,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1554,6 +1547,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1571,14 +1571,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1586,6 +1579,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_average

CPE Platforms

  • cpe:/o:debian:debian_linux:11

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 11   Group contains 20 groups and 45 rules
Group   @@ -483,17 +483,17 @@ 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -514,7 +514,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -522,9 +525,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -554,17 +554,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -585,7 +585,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -593,9 +596,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1480,14 +1480,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1495,6 +1488,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1512,14 +1512,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1527,6 +1520,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1540,14 +1540,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1555,6 +1548,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
+  package { 'ntpdate':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure ntpdate is removed
   package:
     name: ntpdate
@@ -1570,14 +1570,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 High (Enforced) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_high

CPE Platforms

  • cpe:/o:debian:debian_linux:11

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 11   Group contains 23 groups and 50 rules
Group   @@ -354,17 +354,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -399,7 +399,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -407,9 +410,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -706,17 +706,17 @@
 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -737,7 +737,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -745,9 +748,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -777,17 +777,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -808,7 +808,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -816,9 +819,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1704,17 +1704,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1737,14 +1737,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1752,6 +1745,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1769,14 +1769,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal

CPE Platforms

  • cpe:/o:debian:debian_linux:11

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services

Checklist

Group   Guide to the Secure Configuration of Debian 11   Group contains 11 groups and 24 rules
Group   @@ -237,17 +237,17 @@ 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -268,7 +268,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -276,9 +279,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -308,17 +308,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -339,7 +339,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -347,9 +350,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -932,14 +932,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -947,6 +940,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -964,14 +964,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -979,6 +972,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -994,14 +994,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd-ssl
 #	   from the system, and may remove any packages
 #	   that depend on telnetd-ssl. Execute this
@@ -1009,6 +1002,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd-ssl"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
+
+class remove_telnetd-ssl {
+  package { 'telnetd-ssl':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
   package:
     name: telnetd-ssl
@@ -1028,14 +1028,7 @@
                                   [ref]
The telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd_removed
Identifiers and References

References:  - BP28(R1), NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
-
-class remove_telnetd {
-  package { 'telnetd':
-    ensure => 'purged',
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Restrictive Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive

CPE Platforms

  • cpe:/o:debian:debian_linux:11

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 11   Group contains 22 groups and 49 rules
Group   @@ -354,17 +354,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -399,7 +399,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -407,9 +410,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -685,17 +685,17 @@
 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -716,7 +716,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -724,9 +727,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -756,17 +756,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -787,7 +787,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -795,9 +798,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1683,17 +1683,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1716,14 +1716,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1731,6 +1724,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1748,14 +1748,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian11-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Debian 11
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:debian:debian_linux:11

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 11   Group contains 19 groups and 44 rules
Group   @@ -230,17 +230,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -275,7 +275,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -283,9 +286,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -549,17 +549,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -580,7 +580,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -588,9 +591,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1462,17 +1462,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1495,7 +1495,10 @@
 The cron service can be enabled with the following command:
 
$ sudo systemctl enable cron.service
Rationale:
Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_cron_enabled
Identifiers and References

References:  - 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[customizations.services]
+enabled = ["cron"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_cron
 
 class enable_cron {
   service {'cron':
@@ -1503,9 +1506,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["cron"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service cron
   block:
 
@@ -1539,14 +1539,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1554,6 +1547,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1571,14 +1571,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1586,6 +1579,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_average.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_average

CPE Platforms

  • cpe:/o:debianproject:debian:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 9   Group contains 20 groups and 45 rules
Group   @@ -483,17 +483,17 @@ 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -514,7 +514,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -522,9 +525,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -554,17 +554,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -585,7 +585,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -593,9 +596,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1480,14 +1480,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1495,6 +1488,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1512,14 +1512,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1527,6 +1520,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1540,14 +1540,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1555,6 +1548,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
+  package { 'ntpdate':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure ntpdate is removed
   package:
     name: ntpdate
@@ -1570,14 +1570,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 High (Enforced) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_high

CPE Platforms

  • cpe:/o:debianproject:debian:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 9   Group contains 23 groups and 50 rules
Group   @@ -354,17 +354,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -399,7 +399,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -407,9 +410,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -706,17 +706,17 @@
 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -737,7 +737,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -745,9 +748,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -777,17 +777,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -808,7 +808,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -816,9 +819,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1704,17 +1704,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1737,14 +1737,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1752,6 +1745,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1769,14 +1769,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal

CPE Platforms

  • cpe:/o:debianproject:debian:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services

Checklist

Group   Guide to the Secure Configuration of Debian 9   Group contains 11 groups and 24 rules
Group   @@ -237,17 +237,17 @@ 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -268,7 +268,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -276,9 +279,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -308,17 +308,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -339,7 +339,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -347,9 +350,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -932,14 +932,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -947,6 +940,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -964,14 +964,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -979,6 +972,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -994,14 +994,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd-ssl
 #	   from the system, and may remove any packages
 #	   that depend on telnetd-ssl. Execute this
@@ -1009,6 +1002,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd-ssl"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
+
+class remove_telnetd-ssl {
+  package { 'telnetd-ssl':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
   package:
     name: telnetd-ssl
@@ -1028,14 +1028,7 @@
                                   [ref]
The telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd_removed
Identifiers and References

References:  - BP28(R1), NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
-
-class remove_telnetd {
-  package { 'telnetd':
-    ensure => 'purged',
/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_restrictive.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Restrictive Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive

CPE Platforms

  • cpe:/o:debianproject:debian:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 9   Group contains 22 groups and 49 rules
Group   @@ -354,17 +354,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -399,7 +399,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -407,9 +410,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -685,17 +685,17 @@
 
 $ apt-get install syslog-ng-core
Rationale:
The syslog-ng-core package provides the syslog-ng daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_syslogng_installed
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1




+[[packages]]
+name = "syslog-ng"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_syslog-ng
 
 class install_syslog-ng {
   package { 'syslog-ng':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "syslog-ng"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure syslog-ng is installed
   package:
     name: syslog-ng
@@ -716,7 +716,10 @@
 The syslog-ng service can be enabled with the following command:
 
$ sudo systemctl enable syslog-ng.service
Rationale:
The syslog-ng service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Identifiers and References

References:  - BP28(R46), BP28(R5), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1




+[customizations.services]
+enabled = ["syslog-ng"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_syslog-ng
 
 class enable_syslog-ng {
   service {'syslog-ng':
@@ -724,9 +727,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["syslog-ng"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service syslog-ng
   block:
 
@@ -756,17 +756,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -787,7 +787,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -795,9 +798,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1683,17 +1683,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1716,14 +1716,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1731,6 +1724,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1748,14 +1748,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-debian9-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Debian 9
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:debianproject:debian:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Debian 9   Group contains 19 groups and 44 rules
Group   @@ -230,17 +230,17 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220




+[[packages]]
+name = "auditd"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
 
 class install_auditd {
   package { 'auditd':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "auditd"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -275,7 +275,10 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


+[customizations.services]
+enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
 
 class enable_auditd {
   service {'auditd':
@@ -283,9 +286,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["auditd"]

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -549,17 +549,17 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227




+[[packages]]
+name = "rsyslog"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
 
 class install_rsyslog {
   package { 'rsyslog':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "rsyslog"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -580,7 +580,10 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227




+[customizations.services]
+enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
 
 class enable_rsyslog {
   service {'rsyslog':
@@ -588,9 +591,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["rsyslog"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1462,17 +1462,17 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[[packages]]
+name = "cron"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
 
 class install_cron {
   package { 'cron':
     ensure => 'installed',
   }
 }
-


-[[packages]]
-name = "cron"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1495,7 +1495,10 @@
 The cron service can be enabled with the following command:
 
$ sudo systemctl enable cron.service
Rationale:
Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_cron_enabled
Identifiers and References

References:  - 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3




+[customizations.services]
+enabled = ["cron"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_cron
 
 class enable_cron {
   service {'cron':
@@ -1503,9 +1506,6 @@
     ensure => 'running',
   }
 }
-


-[customizations.services]
-enabled = ["cron"]

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service cron
   block:
 
@@ -1539,14 +1539,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1554,6 +1547,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1571,14 +1571,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1586,6 +1579,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
/usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -100,7 +100,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 10
       This guide presents a catalog of security-relevant
 configuration settings for Debian 10. It is a rendering of
@@ -143,24 +143,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -168,24 +188,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -193,14 +208,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -213,21 +228,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -2038,6 +2038,11 @@
                   SRG-OS-000363-GPOS-00150
                   SRG-OS-000445-GPOS-00199
                   The AIDE package must be installed if it is to be available for integrity checking.
+                  
+[[packages]]
+name = "aide"
+version = "*"
+
                   include install_aide
 
 class install_aide {
@@ -2046,11 +2051,6 @@
   }
 }
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -3841,6 +3841,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3849,11 +3854,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3885,6 +3885,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -3893,11 +3898,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -100,7 +100,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 10
       This guide presents a catalog of security-relevant
 configuration settings for Debian 10. It is a rendering of
@@ -143,24 +143,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -168,24 +188,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -193,14 +208,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -213,21 +228,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -2038,6 +2038,11 @@
                   SRG-OS-000363-GPOS-00150
                   SRG-OS-000445-GPOS-00199
                   The AIDE package must be installed if it is to be available for integrity checking.
+                  
+[[packages]]
+name = "aide"
+version = "*"
+
                   include install_aide
 
 class install_aide {
@@ -2046,11 +2051,6 @@
   }
 }
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -3841,6 +3841,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3849,11 +3854,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3885,6 +3885,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -3893,11 +3898,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -19,148 +19,136 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
-      
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
-      
-    
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
-      
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
-      
-    
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Ensure auditd Collects Information on Kernel Module Unloading - delete_module
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Disable storing core dump
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Ensure auditd Collects Information on Kernel Module Loading and Unloading
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Kernel panic on oops
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Record Unsuccessful Access Attempts to Files - creat
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Set Password Maximum Age
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Sign kernel modules with SHA-512
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
       
     
-    
-      Enable checks on credential management
+    
+      Verify Root Has A Primary GID 0
       
-        ocil:ssg-kernel_config_debug_credentials_action:testaction:1
+        ocil:ssg-accounts_root_gid_zero_action:testaction:1
       
     
-    
-      Ensure /var/log/audit Located On Separate Partition
+    
+      Verify User Who Owns /var/log/syslog File
       
-        ocil:ssg-partition_for_var_log_audit_action:testaction:1
+        ocil:ssg-file_owner_var_log_syslog_action:testaction:1
       
     
-    
-      Disable storing core dump
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchown
       
-        ocil:ssg-coredump_disable_storage_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1
       
     
-    
-      Configure auditd Disk Full Action when Disk Space Is Full
+    
+      Record Unsuccessful Access Attempts to Files - open
       
-        ocil:ssg-auditd_data_disk_full_action_action:testaction:1
+        ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1
       
     
-    
-      Ensure the Default Umask is Set Correctly in login.defs
+    
+      Enable syslog-ng Service
       
-        ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1
+        ocil:ssg-service_syslogng_enabled_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchmod
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup gshadow File
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Enable Encrypted X11 Forwarding
+    
+      Don't target root user in the sudoers file
       
-        ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1
+        ocil:ssg-sudoers_no_root_target_action:testaction:1
       
     
-    
-      Ensure the Logon Failure Delay is Set Correctly in login.defs
+    
+      Enable SLUB debugging support
       
-        ocil:ssg-accounts_logon_fail_delay_action:testaction:1
+        ocil:ssg-kernel_config_slub_debug_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup shadow File
/usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian10-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Debian 10
   This guide presents a catalog of security-relevant
 configuration settings for Debian 10. It is a rendering of
@@ -43,24 +43,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
+    
+      
+        
+      
+    
     
       
         
       
     
+    
+      
+        
+      
+    
+    
+      
+        
+      
+    
     
       
         
       
     
+    
+      
+        
+      
+    
     
       
         
       
     
-    
+    
       
-        
+        
       
     
     
@@ -68,24 +88,19 @@
         
       
     
-    
-      
-        
-      
-    
     
       
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -93,14 +108,14 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -113,21 +128,6 @@
         
       
     
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
   
   
   0.1.64
@@ -1938,6 +1938,11 @@
               SRG-OS-000363-GPOS-00150
               SRG-OS-000445-GPOS-00199
               The AIDE package must be installed if it is to be available for integrity checking.
+              
+[[packages]]
+name = "aide"
+version = "*"
+
               include install_aide
 
 class install_aide {
@@ -1946,11 +1951,6 @@
   }
 }
 
-              
-[[packages]]
-name = "aide"
-version = "*"
-
               - name: Ensure aide is installed
   package:
     name: aide
@@ -3741,6 +3741,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+          
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
           include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3749,11 +3754,6 @@
   }
 }
 
-          
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
           - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3785,6 +3785,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+          
+[[packages]]
+name = "nss-tools"
+version = "*"
+
           include install_nss-tools
 
 class install_nss-tools {
@@ -3793,11 +3798,6 @@
   }
 }
 
-          
-[[packages]]
-name = "nss-tools"
-version = "*"
-
           - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -6696,6 +6696,11 @@
/usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -100,7 +100,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 11
       This guide presents a catalog of security-relevant
 configuration settings for Debian 11. It is a rendering of
@@ -143,24 +143,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -168,24 +188,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -193,14 +208,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -213,21 +228,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -2038,6 +2038,11 @@
                   SRG-OS-000363-GPOS-00150
                   SRG-OS-000445-GPOS-00199
                   The AIDE package must be installed if it is to be available for integrity checking.
+                  
+[[packages]]
+name = "aide"
+version = "*"
+
                   include install_aide
 
 class install_aide {
@@ -2046,11 +2051,6 @@
   }
 }
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -3841,6 +3841,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3849,11 +3854,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3885,6 +3885,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -3893,11 +3898,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -100,7 +100,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 11
       This guide presents a catalog of security-relevant
 configuration settings for Debian 11. It is a rendering of
@@ -143,24 +143,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -168,24 +188,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -193,14 +208,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -213,21 +228,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -2038,6 +2038,11 @@
                   SRG-OS-000363-GPOS-00150
                   SRG-OS-000445-GPOS-00199
                   The AIDE package must be installed if it is to be available for integrity checking.
+                  
+[[packages]]
+name = "aide"
+version = "*"
+
                   include install_aide
 
 class install_aide {
@@ -2046,11 +2051,6 @@
   }
 }
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -3841,6 +3841,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3849,11 +3854,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3885,6 +3885,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -3893,11 +3898,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -19,148 +19,136 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
-      
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
-      
-    
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
-      
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
-      
-    
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Ensure auditd Collects Information on Kernel Module Unloading - delete_module
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Disable storing core dump
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Ensure auditd Collects Information on Kernel Module Loading and Unloading
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Kernel panic on oops
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Record Unsuccessful Access Attempts to Files - creat
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Set Password Maximum Age
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Sign kernel modules with SHA-512
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
       
     
-    
-      Enable checks on credential management
+    
+      Verify Root Has A Primary GID 0
       
-        ocil:ssg-kernel_config_debug_credentials_action:testaction:1
+        ocil:ssg-accounts_root_gid_zero_action:testaction:1
       
     
-    
-      Ensure /var/log/audit Located On Separate Partition
+    
+      Verify User Who Owns /var/log/syslog File
       
-        ocil:ssg-partition_for_var_log_audit_action:testaction:1
+        ocil:ssg-file_owner_var_log_syslog_action:testaction:1
       
     
-    
-      Disable storing core dump
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchown
       
-        ocil:ssg-coredump_disable_storage_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1
       
     
-    
-      Configure auditd Disk Full Action when Disk Space Is Full
+    
+      Record Unsuccessful Access Attempts to Files - open
       
-        ocil:ssg-auditd_data_disk_full_action_action:testaction:1
+        ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1
       
     
-    
-      Ensure the Default Umask is Set Correctly in login.defs
+    
+      Enable syslog-ng Service
       
-        ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1
+        ocil:ssg-service_syslogng_enabled_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchmod
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup gshadow File
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Enable Encrypted X11 Forwarding
+    
+      Don't target root user in the sudoers file
       
-        ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1
+        ocil:ssg-sudoers_no_root_target_action:testaction:1
       
     
-    
-      Ensure the Logon Failure Delay is Set Correctly in login.defs
+    
+      Enable SLUB debugging support
       
-        ocil:ssg-accounts_logon_fail_delay_action:testaction:1
+        ocil:ssg-kernel_config_slub_debug_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup shadow File
/usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian11-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Debian 11
   This guide presents a catalog of security-relevant
 configuration settings for Debian 11. It is a rendering of
@@ -43,24 +43,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
+    
+      
+        
+      
+    
     
       
         
       
     
+    
+      
+        
+      
+    
+    
+      
+        
+      
+    
     
       
         
       
     
+    
+      
+        
+      
+    
     
       
         
       
     
-    
+    
       
-        
+        
       
     
     
@@ -68,24 +88,19 @@
         
       
     
-    
-      
-        
-      
-    
     
       
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -93,14 +108,14 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -113,21 +128,6 @@
         
       
     
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
   
   
   0.1.64
@@ -1938,6 +1938,11 @@
               SRG-OS-000363-GPOS-00150
               SRG-OS-000445-GPOS-00199
               The AIDE package must be installed if it is to be available for integrity checking.
+              
+[[packages]]
+name = "aide"
+version = "*"
+
               include install_aide
 
 class install_aide {
@@ -1946,11 +1951,6 @@
   }
 }
 
-              
-[[packages]]
-name = "aide"
-version = "*"
-
               - name: Ensure aide is installed
   package:
     name: aide
@@ -3741,6 +3741,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+          
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
           include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3749,11 +3754,6 @@
   }
 }
 
-          
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
           - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3785,6 +3785,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+          
+[[packages]]
+name = "nss-tools"
+version = "*"
+
           include install_nss-tools
 
 class install_nss-tools {
@@ -3793,11 +3798,6 @@
   }
 }
 
-          
-[[packages]]
-name = "nss-tools"
-version = "*"
-
           - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -6696,6 +6696,11 @@
/usr/share/xml/scap/ssg/content/ssg-debian9-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian9-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian9-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -100,7 +100,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 9
       This guide presents a catalog of security-relevant
 configuration settings for Debian 9. It is a rendering of
@@ -143,24 +143,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -168,24 +188,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -193,14 +208,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -213,21 +228,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -2038,6 +2038,11 @@
                   SRG-OS-000363-GPOS-00150
                   SRG-OS-000445-GPOS-00199
                   The AIDE package must be installed if it is to be available for integrity checking.
+                  
+[[packages]]
+name = "aide"
+version = "*"
+
                   include install_aide
 
 class install_aide {
@@ -2046,11 +2051,6 @@
   }
 }
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -3841,6 +3841,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3849,11 +3854,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3885,6 +3885,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -3893,11 +3898,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-debian9-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian9-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian9-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -100,7 +100,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Debian 9
       This guide presents a catalog of security-relevant
 configuration settings for Debian 9. It is a rendering of
@@ -143,24 +143,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
           
         
+        
+          
+            
+          
+        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -168,24 +188,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -193,14 +208,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -213,21 +228,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -2038,6 +2038,11 @@
                   SRG-OS-000363-GPOS-00150
                   SRG-OS-000445-GPOS-00199
                   The AIDE package must be installed if it is to be available for integrity checking.
+                  
+[[packages]]
+name = "aide"
+version = "*"
+
                   include install_aide
 
 class install_aide {
@@ -2046,11 +2051,6 @@
   }
 }
 
-                  
-[[packages]]
-name = "aide"
-version = "*"
-
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -3841,6 +3841,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+              
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
               include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3849,11 +3854,6 @@
   }
 }
 
-              
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3885,6 +3885,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+              
+[[packages]]
+name = "nss-tools"
+version = "*"
+
               include install_nss-tools
 
 class install_nss-tools {
@@ -3893,11 +3898,6 @@
   }
 }
 
-              
-[[packages]]
-name = "nss-tools"
-version = "*"
-
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-debian9-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-debian9-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian9-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -19,148 +19,136 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
-      
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
-      
-    
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
-      
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
-      
-    
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Ensure auditd Collects Information on Kernel Module Unloading - delete_module
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Disable storing core dump
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Ensure auditd Collects Information on Kernel Module Loading and Unloading
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Kernel panic on oops
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Record Unsuccessful Access Attempts to Files - creat
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Set Password Maximum Age
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Sign kernel modules with SHA-512
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
       
     
-    
-      Enable checks on credential management
+    
+      Verify Root Has A Primary GID 0
       
-        ocil:ssg-kernel_config_debug_credentials_action:testaction:1
+        ocil:ssg-accounts_root_gid_zero_action:testaction:1
       
     
-    
-      Ensure /var/log/audit Located On Separate Partition
+    
+      Verify User Who Owns /var/log/syslog File
       
-        ocil:ssg-partition_for_var_log_audit_action:testaction:1
+        ocil:ssg-file_owner_var_log_syslog_action:testaction:1
       
     
-    
-      Disable storing core dump
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchown
       
-        ocil:ssg-coredump_disable_storage_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1
       
     
-    
-      Configure auditd Disk Full Action when Disk Space Is Full
+    
+      Record Unsuccessful Access Attempts to Files - open
       
-        ocil:ssg-auditd_data_disk_full_action_action:testaction:1
+        ocil:ssg-audit_rules_unsuccessful_file_modification_open_action:testaction:1
       
     
-    
-      Ensure the Default Umask is Set Correctly in login.defs
+    
+      Enable syslog-ng Service
       
-        ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1
+        ocil:ssg-service_syslogng_enabled_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchmod
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup gshadow File
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Enable Encrypted X11 Forwarding
+    
+      Don't target root user in the sudoers file
       
-        ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1
+        ocil:ssg-sudoers_no_root_target_action:testaction:1
       
     
-    
-      Ensure the Logon Failure Delay is Set Correctly in login.defs
+    
+      Enable SLUB debugging support
       
-        ocil:ssg-accounts_logon_fail_delay_action:testaction:1
+        ocil:ssg-kernel_config_slub_debug_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup shadow File
/usr/share/xml/scap/ssg/content/ssg-debian9-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-debian9-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-debian9-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Debian 9
   This guide presents a catalog of security-relevant
 configuration settings for Debian 9. It is a rendering of
@@ -43,24 +43,44 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
+    
+      
+        
+      
+    
     
       
         
       
     
+    
+      
+        
+      
+    
+    
+      
+        
+      
+    
     
       
         
       
     
+    
+      
+        
+      
+    
     
       
         
       
     
-    
+    
       
-        
+        
       
     
     
@@ -68,24 +88,19 @@
         
       
     
-    
-      
-        
-      
-    
     
       
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -93,14 +108,14 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -113,21 +128,6 @@
         
       
     
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
   
   
   0.1.64
@@ -1938,6 +1938,11 @@
               SRG-OS-000363-GPOS-00150
               SRG-OS-000445-GPOS-00199
               The AIDE package must be installed if it is to be available for integrity checking.
+              
+[[packages]]
+name = "aide"
+version = "*"
+
               include install_aide
 
 class install_aide {
@@ -1946,11 +1951,6 @@
   }
 }
 
-              
-[[packages]]
-name = "aide"
-version = "*"
-
               - name: Ensure aide is installed
   package:
     name: aide
@@ -3741,6 +3741,11 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
+          
+[[packages]]
+name = "gnutls-utils"
+version = "*"
+
           include install_gnutls-utils
 
 class install_gnutls-utils {
@@ -3749,11 +3754,6 @@
   }
 }
 
-          
-[[packages]]
-name = "gnutls-utils"
-version = "*"
-
           - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3785,6 +3785,11 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
+          
+[[packages]]
+name = "nss-tools"
+version = "*"
+
           include install_nss-tools
 
 class install_nss-tools {
@@ -3793,11 +3798,6 @@
   }
 }
 
-          
-[[packages]]
-name = "nss-tools"
-version = "*"
-
           - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -6696,6 +6696,11 @@
RPMS.2017/scap-security-guide-redhat-0.1.64-0.0.noarch.rpm RPMS/scap-security-guide-redhat-0.1.64-0.0.noarch.rpm differ: byte 225, line 1
Comparing scap-security-guide-redhat-0.1.64-0.0.noarch.rpm to scap-security-guide-redhat-0.1.64-0.0.noarch.rpm
comparing the rpm tags of scap-security-guide-redhat
--- old-rpm-tags
+++ new-rpm-tags
@@ -727,14 +727,14 @@
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-pci-dss.html db79275aebfafb497ee0835d577d96a53480c5567ab534d4cc5ce68ab8b2a6fa 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-standard.html 8b063a74d97817dbce935bb2f46e13a46e094a214ef76b28dbecacc90ff2f8c2 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_enhanced.html 0be3e4160e3241c05c493b525ad60de1d68d166aab8bce91f01ef49ab8fd9724 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_high.html 6897dc8f6092b6bc289b5a6b0cecc0b3db64154f9e6b5694962d9e8e9a5bf7e6 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_intermediary.html dcfb5acb8c8cc6a51964020b069869066be24dc356d06ec798be6ead2d714b28 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_minimal.html 692c2c9570186f1b368b48cdd79e4e40ce2f87c8dab8a07994d6dca9d5fdbaff 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis.html 1d639915440957995b719f09e76bb437e0a8065a85c986b0cdf550d2be8d9ca7 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_server_l1.html 18d6816211cae0b38f9cc32c0deb4e2957056874115646e123e68823c2cde72c 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l1.html af635edd7e04f3416f81a6ecd81de5f01be4232e61200ab52355e16fdd1215ad 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l2.html c94c2e24aeea70868154d57d2237362bc282b0dcc57fa79b7f3a8ea9ead47d98 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cjis.html 4ac494b767e7ea790f9a8394e8461022a7c435328827e3294cbf9d91d19e0746 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cui.html 31b0cd22115bc23bb820e4f7df354f5121508188d99c7c8462c5d472a1f7df05 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-e8.html 506cfd38d8b1db9442dfc14cc96c916f9abd12c84af0c41420d99f99a2e090fd 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-hipaa.html 2cf391ae98382358c956fb6611371e8a8884e297c8f69df2097c1210c703fe29 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-pci-dss.html 6a549e139696e6a1fbad58c4d335ae288f79cd5064d4f38ea909eb4979d24f0d 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-standard.html 9f26e7f20267dd602ec28a1027258d920d0dba18a6891dfd1d850c5ffc9e8702 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_enhanced.html 519b8f97f45cf2257c066292fc2b67e73fadf947090d33896dc8bbb797c7a443 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_high.html 7c65be0a79683edafa1016c361a2bfff3b1cf91cec2131901e0978cd75df92ba 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_intermediary.html ea482da165282b96eabf083a3612ba854f7f7912b820cdc7edbfc6cfe32634fb 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_minimal.html 44eea43575a79de4f047525399d43154d61ecd863f89539831fb7891f02534da 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis.html 1d7676f112416cbb2d93a62f84c0b14761212f50f2e3f160c60722ba63830e68 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_server_l1.html 4087207b7dde527afb40085928466d702b323bf01d58fc3588aecdd9dd23f0c4 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l1.html f311a776c5ca7bcb12468a2c463e22535d2fbaaa26975d30b6b0d96cace89f46 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l2.html dd394cb00765074329fe3607c30aba3c447a1d4c3adf04e82ad527b4aa52d235 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cjis.html 154578014a53bc2316c12374e507612cd2cc43bcd32e4d8268fe096de5eee0d2 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cui.html 5dfd6dfd4063042cbbb439e8e49b0ee60fbd5e6382a12d9931972f4ba34d51c6 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-e8.html 58f529ee1a441e8015c918bf032947b39d813c950e2702049661901b4cb0334d 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-hipaa.html 067dfdfe5815b772fee4a5548378e72775962886d7625829960d2824d595e75e 2
@@ -742,18 +742,18 @@
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ism_o.html 8caf7de8ba50a4fbd102fdc833dfd930f0ddba50483c687cbf633f6439353f48 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ospp.html ca87615f218a0a9fa4132a20db80e353df18d27cf460dd2cd340ae65b5976fe9 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-pci-dss.html 2f458a555ef143847f254bed738397f0aa681f78f628f0f620f6fec61400f3d1 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-rht-ccp.html d794f953ced3d837abfa9a3af554f06bbe8249c6f544a46ab98b713c6d48c602 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-standard.html 561497582d382fa7f58e4811af8866beb0b5e096f9db654f3c1a2d202b2b45bf 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig.html 63011f1b18461eef8720ae1ea4fce9b4efd160fecc548fbb400950ac6c00c1f6 2
-/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig_gui.html c92f570a79eb0b839fdb9cc153d5dd591bef4657a0d22f17c23813ea3690fb41 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_enhanced.html 81fa349b996284c12e99609889759c73cfc1778075dd683907135a1a8229e33b 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_high.html 76202141bbf8a99b904d3be4fb1e6f81307e98cceb8770a0fe19aac25bb25042 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_intermediary.html 697352c5528130f31bec24459164ff23f51b1c4b57c11947638edbdaca3475f9 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_minimal.html 932b8c3008242d75018eeae0f600b42f45dfb308e781d3f04779b886bdf6a43b 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis.html 43df5889cc4de4df13f586f416768b1c33729c2c40333135d3dd6b40cfc5929b 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_server_l1.html d88a6038c16a72bc846ff51f12c650486cb1b420e773d9fe3b84251df67ea792 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l1.html f721b0e685ffde9fe40ec8fe66d5617b778b3a073d604094e71de45b5a94ddf7 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l2.html ca080b6248277a1ccecdbda7a07d715331f8495d3a1d8b9df3ecd09e7fe9e26b 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cui.html cb9d1851c236635b572d55874d015e4c6194599f640926e558cebedd67f81a90 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-e8.html 6cda6591adc7241227c82ac07b44ce1861fb5c6d069b5bdb55cf95e2fea94b5c 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-hipaa.html e946ec49c7eb2ccdb451c26b62d8e0f9c518b8780699fa012b75f0e33f8d8362 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ism_o.html 6739ca9082108f4775759455c248eff4185aa93f74f9f9311cda95b2825d7a45 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ospp.html 8981f911d4b8de3ddacf968f37a095ffc3eaaa24d76462374a48bfcbd14b6cb3 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-pci-dss.html 06d10bdb4ca802c1d6af893e3a0eeef439fabdf35c6a02903ea2439210a551ac 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-rht-ccp.html e5c22e0abea0a7e4aa6c049dcd507b736c3c69f82d52d34f085f964a7fed13ae 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-standard.html bad75a1b7c8e4e5564f3ac4b3b4bdc1a0298c8341221c7d154749e8c227a3128 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig.html bfbde3cb5c1a781472afc78c6548f5ec48daee0e578f7fc5bd3ad1402e9b9ecc 2
+/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig_gui.html 2f1b9f9231cfc3494ac4147e590a82955301694411a398d984e90c6d6c1971b7 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_enhanced.html 172d31ccbec590799f1f62045ffb856d23c5da80f24f984335e27aa2823c539c 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_high.html e34d41b8f67e9ec26cb302d66dc681d3dee499a8d8a7f955912bbf37fda65027 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_intermediary.html 1322eea408450693199af22126c9719d84d7180c9989f9821d03615305682798 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_minimal.html 3edad92e67fa183e8b46fe11e234f2739ab3fca729b499dd855df63c7744c20d 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis.html 08f071f9b032c6f54b55e65b3788df74552a8b07b0ccabc8a06b914b9904638e 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_server_l1.html 9f86b6a8112094fffcf671717f7416b329ff6acf51492a9b9fb42491987b74b4 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l1.html 7adabf258f7cf03ad397e551afca77faa2e4172ced0a5cf414bf4714f9e8a109 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l2.html 5d15a5c138326dc4a8e9fabfb7f3a987a9ae0696b606ba9ecf2759378742b7b1 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cui.html 2c8bac3e4c9f80baf74de37192ba32a4a5142252ef67841dec4eb02064d930f7 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-e8.html 95b41a0907c21fa82f5e13ece3b226dce5c5ba4c612a3bca526e1a220941acaa 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-hipaa.html 4b918708e52d5cca508f50723d83d8076b5db66c52a3f83555bbbe6f5869dc97 2
@@ -761,5 +761,5 @@
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ism_o.html 2fbe083042dc46530810856823d796c76eee6198b4470393a04e271667fdb13d 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ospp.html c2d391a37661e410ee528b40882818a9f21249c37bcbf84f59e47a3cf0146302 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-pci-dss.html 8c71794224d5540e21fc98cda13d5bf1f3fe3973fb343d70a88ecdcfce36c529 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig.html 36ba190ba5a9832489581f85875f210390b90a3c24b0b0f3d5e5c288d2076abd 2
-/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig_gui.html 932b59d4bb9fe25a4d55b3fd463812377d6102ab99a9486e8d7be7874c41efb2 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ism_o.html 792ea82f83cc7ff3c07b5251c051344123872c5f0440df03bcf328d5f599e5dc 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ospp.html d12234518405223ba0180b2f0edbebe9a21bc832ca90fabf9c365447d645de75 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-pci-dss.html eb378fe16fc48c62a66e86770e9e803fc7ab2b9939707b57b63d52f4219e49ed 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig.html 9f0c771f1f1dd1ac8042ed4151c0b2c423720a38c29d0a056cbe46e6e8a88886 2
+/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig_gui.html 4ac011b2ba26ada6c69aa69fc9074383c6a1cd60a8e4b888e0b6c7f164b0c039 2
@@ -767,11 +767,11 @@
-/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-ospp.html fc588cb96a249de66bb0bc118f8a94817243ea4d87ec8133fa6e4b917897d62c 2
-/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-pci-dss.html 09d91fdb296bddfc80ca651ecbd1ae569e4459f8437e0f1a1bd73cfbda8c85bd 2
-/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-standard.html ed5d714b80fd76efaabd6bdcb7d5f043384d17970cf8961700e254dd74c773b6 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_enhanced.html a9f4c35f5063e2a9d0731b25f029e0ef3e4543b33be0324781ed3d5b1990df31 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_high.html f5d15aa8b3039f0aaf036d9b590c5b8fbc0093cfcebc7007811f99190bb66beb 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_intermediary.html c34951efdfc93fd47ddeb1f8c42d85d3703959d6015d07548c67e0564760cf1f 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_minimal.html dee5f49abccde9de75776fbbc788e9f28f7bb5412cfdcac4a499c05e1ccf81b5 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cjis.html 8917cc90cf9a14296150068e48e7303e6844068d97c0ad30778064b83e9f37ff 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cui.html 6c9b13201d7eef0d39c697c35fd3d36becd94fda6fb6aec8455152aceb1258db 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-e8.html 96806d3adbb6b65beedc2619875d8855ed5bdb1c52eb6018292d763fe94abb09 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-hipaa.html a593337c484c58ac630d63586061f3bbfc2c2076f81c0129ef8639533623766d 2
+/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-ospp.html 271049f6bebf90514d03d0a2eda19545c95051694b159dd8d10e12de74380b8d 2
+/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-pci-dss.html 796e33b76550726fc681a3c72082857126693de048627c9f40f7a47dbd57bfd6 2
+/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-standard.html d144209014aa161904b70ef5b32f6b2f675c2d1f2edbe086562293635b5299e7 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_enhanced.html 0db69c80f8f083871556044b922b5811c6e774271dbbce4be35c6d32f7fa7541 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_high.html d13806b65937d40c5065de94040b7ec5cdc4b7e54578d2fe18295b858d3ba897 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_intermediary.html 0358b455db38458db83802c738d9819f373f8a438345316782809e3c116b5b98 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_minimal.html c8144469ee6d242a2ef56a5b32f6fabb551f37d43e0dda994451a76b4906ae7b 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cjis.html 78e53b762af1673e554543b4ee633983ffb4aefffe2fce6fb6d738d8816b3cb1 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cui.html b276da944253ae8b127d400226b2d814db75e279ecbab634e9b42151a085f9bd 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-e8.html 59669466cc2a8e12d4bc20d260a6df778092cf5529a4a44aa0d4c6b8b38968b6 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-hipaa.html 45c9a1e02b9e7f61cba1faa0d87928a7fc4c0fc1bedf1b459dfd8282a230ab5d 2
@@ -779,15 +779,15 @@
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ncp.html 0ff1ae0fca1e8e1cb0b899c1390e8ec13c6a3723e2cbbd91cbb5c9f2e2b36648 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ospp.html bc83b393f190da78b96f9350016b6fcd38b3abea6cd866f3a267908a9fa57268 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-pci-dss.html 48f713259c34801e62ca14347772ebb1db90b0cfc3e5c747b3d9e5bd6127732d 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-sap.html af47d61f9a2a0c41e1387686ca39b0598cd8aaaa959eb2606b70540a1d657099 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-standard.html d9861b99558627a766175d322a35f582846b4d3549f3f2b9c089f1c404200f45 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig.html 431ae1c338514cd0796739c4f14bd93dbbc09987e83e7fdd2cd234bf68f07c8a 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig_gui.html 7d74357958eabfb90f53b9fa5ff6223d64a87a10c8d7ca6aeb1402b39db26043 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_enhanced.html 0fcef9c44e3712ef5d3a32a0bcd792d6b12f0ee3a0956b82d2cf4486ff83f508 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_high.html bb86fe951d9bb058d9ea8bd63da3d113d4ce66db4cf6c04239c6508be68a5100 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_intermediary.html fcd08831bb9b33011ae44f9739fe8d3b4b5159495a6d55e272b72a1d9a2fa0da 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_minimal.html dae8439f5a64702b72cb31ea3690da8859b279853cf1e3de9d0957cc3a0c3479 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cjis.html 1a87fa8a5bbc7030eabe6febb4cb8dcdaee103ca391b29c23cc701cc408fd3fb 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cui.html e71f17d95b9956104caa40a10cdb2fcac33badbbb71d753b0e3b2f9754214f1d 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-e8.html 32ba6f71b69f3ecce04b817dc6a90143e8699688335b8e05b1af8e71c1d294e8 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-hipaa.html c6806fb76c125fb59d5f25d8148460ea4e335a9a16d6dbdcdc614996d8a39f34 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ncp.html 90c2d1c07052e48ba627b66b152a8ea3b8202a4235e254bf032228b8cafd8753 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ospp.html 87a1b1e9a77e9845731f8d2f856a7bd9b1242499432ad7655ce0beeca08250b7 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-pci-dss.html c6918d88de2cab43e195101290986a45c375f5e15667b8939d9f43e10d54d184 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-sap.html 6f4b398d0623fe34a200467f72c7e3c5f0efb973c9f5b4a91f4921da667e4955 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-standard.html 3572a5aa31315e3fdeaa62d5a3d5bf6ecfa36e2dc388c6fc368d69fa8fb76a96 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig.html dbf753ec0db54c945f74f73b3111792ce3d732b22a2a9655e79d46f981afc25d 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig_gui.html dbb8a02bd2265570b5ba76df87e026733de05c1d46b0ad37238937aefa2e4cdf 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_enhanced.html 59453695a9c8b5514b5fb2f685da03039eed325cdc60e45ada5bc011b52c43fd 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_high.html a0be4ec3dada59883e67db0d0cb36838105db2ec50ba59396cc67318287c6fb2 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_intermediary.html 9d671e527197bbf10abc568259601c7bf53ffe3cea6850ffbbccb5f8c5924b68 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_minimal.html ae2f8665fd3cb1eb7bec956a08dcc597815025b30e81931a30479f6d4d3f2183 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cjis.html 67f367e88ccd9fc173fdb3529d504dbc5ab43a157e179c523eb7d39e439cebb5 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cui.html 17a65c4713015292162e610a3b02030d0cfbc5e9bdcccda9b123f90717700d1f 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-e8.html b60ea652aa3de363852ca6a597977f243687b2dee93716d65381958b7489b1e8 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-hipaa.html cbe5d1c8e7f1fe04ff4180e9b752671c500746c582017cca2bc06fef3117d1dd 2
@@ -795,11 +795,11 @@
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-ospp.html 3abad463bbda602b8903d785fc5365fdf04669a547e8fe1eb99a8666ba5e90fa 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-pci-dss.html d073dd7c9ff55bc4cb75b2f0c1663f67981223a419da0deb53d04e592192d0b7 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-standard.html 75b42fd39111153ba0532c231a409405ce03439e8224aaec06e0eb03414c3beb 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig.html d6765baafd83726239dc999763c329232021094458af25a50fa046808eee6eb1 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig_gui.html 953c29a880b1d00668bcdee7dd1958971611b08e1dffac1a19fa50f1b78b61df 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_enhanced.html b859c3cf341b86cc701ca482040c7af7f524a7de46d31d1b091bd7ee4dd8aebf 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_high.html df4b9acab024c5e04813e6779276317db33d8867fa6bd1488475639e86e107ec 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_intermediary.html cf63d1b682e81960e100aa6e06c1b0128ba4d1eafa0b7e13af850317058449e2 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_minimal.html f95b3ef1980a75bb3d8cfbc6dfd620084a73d457ea11a59de044a452e0ad3199 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-e8.html fc547227abba4f91682807c23850c354564bf38de45cf22b919dc79f235445d5 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-hipaa.html a129e8dfcd68db6b7148eea25883a8e5fdba56549e0befa7b9e79e8b78ab8e58 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-ospp.html 59d017deac9e1f90a5f0d520de030572fe022fe74d29ef38acc338bf351c08d1 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-pci-dss.html b18aa8d7846ae940b6965f123cac868da95f755cccc2cad1593f169e5c574626 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-standard.html dd30a3aafb623649782b7a21f5fe90c17bbeae393aee945c50f23d441d116762 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig.html e5614b5780bdd8370fa7b084ecb63663517afa241904390cf6599c97a8b0d6b5 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig_gui.html 5015752cc0f937b2ba4a8884e4877898de40ff138c6cb5433dd2f2eceeb01bc9 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_enhanced.html b44770f28eabf10941343b6bdf091d807af352cbba72a39281ecfe0643cc5771 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_high.html 59f1469aa2d6f9464bfff29fcb5315f9bc3ddb2867ccd9f8ae918c52c59ad4d5 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_intermediary.html 7c444b42a4513157f70c9bb07b4f9852227509632b7dbdde4613faab817aa82e 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_minimal.html 7231e0b5f558b349c549d36cea741e00ac403ddf5d79b99d51ff7ad6bca32330 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-e8.html 47f61c5c6b23af0b5bb5151a80d980f451c7aeca3b61e4e690e68d1495b9135e 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-hipaa.html b652b5f86334f8504240807ec5c8fad3f759e94043808aec4bb6282ad0c32f29 2
@@ -807,10 +807,10 @@
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-ospp.html 732e4ec58ad476f1a6e679c762c695d6108ffcc3fb97c7c415f4857163c28ca6 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-standard.html e203842e646c95b19b874b1c31aa73a590bc9d582dd4b003d6bd76202353085d 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig.html df30f38adde77cb062b79b6660b4dca4f0ffbcade97374b5a0aedff99b1578ae 2
-/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig_gui.html ac60d62e9e1dd92d2cdb71872a8857a83ae78712fa49bd551b46270e6b881d2b 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_enhanced.html 6957faab47a26b138e924061230b0fc8105153f8af4ad367cdaf961b560b9a81 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_high.html f1b82e59473f7dba988b36d8ffe89bb1c7c3fe8d79ef6064bbe3d3e17351b92a 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_intermediary.html 6b33e926c3fe89390de984f93d714e9dc3a3c662a58a501238fb9792504b3079 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_minimal.html 5fb1046f5381a173a088225c6a1993c94b9077517dda5aec9f3f37cf0037b59d 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-e8.html c75772721e1090a1b0d568f12398a8d6b5cad6c8045f839c4fe5d87b87ce5dbd 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-high.html 6ae2dd87062e7b92b32eac918b048611445259f18541b87e2c339e707ae1c204 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-ospp.html b1e429df79eae5231d87af160141c9f66667af472461b91e0aa28dde0a3b81cd 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-standard.html 1ed70579ccc977d8c25846f63218f94494849e8e9bb183f8ed60bddc6000dfc7 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig.html 596b90f69f4d754216ec409334f93acf5fc6897e6d3cb95afd5eaa71ac43dc9a 2
+/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig_gui.html 412e44ead35bd8f4e1dabefd8474a6e7b7ce945f7720bbe04df89cca906f442a 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_enhanced.html fd8e283c2051e0a5bdcdf41b1b2b21737da58baaa3d34bf36654112cb3abbf8c 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_high.html e89fb3508b855349128c2982aabea0ab3ae145f4a01563e7412e55137764c3e5 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_intermediary.html 301c69fbaf25369a238f1369e8f56cd38194498a202071be99781fa01655fb6d 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_minimal.html 85fa3912a77a41d2a24f6ac9f969dc89bee0bb593425f22de41ac752ed503769 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-e8.html ce7e1d8c94743dd7f6abbfaa38cdbaf6f8d720758cae76c269f3769b9a01e08e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-high.html 02b29228763cbdb3e39ccdb82d674cddd0f82bfa028655ef4bc82eb4c36497af 2
@@ -818,15 +818,15 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-moderate.html 4874da64a89f4d64254c06e8c9a7f8f5ebc3165a9daa3688e66c7bb4f7bc7637 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-nerc-cip.html 242182ca24f4466859f6cf311a691a583813d2873365248b836e248add28c9c5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-C2S.html 51c3f0824af2a2a23d8dffd4fa3fe5eacc4f35f4e7ea34f792ddfaa4bc539c1d 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_enhanced.html e06257668af67aba3788be83c483d4af88f53f7168f366abb972591e302ab73d 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_high.html a883419cef20af9d2de89d7c5ab729043cad1f5efc8d7c626e9e9bbf1e6398bd 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_intermediary.html 19f03a4f38af31db3f932f28cde62ce0267eb55c2d3f5109e3f850f9f1adfe88 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_minimal.html 7a98c1639094fb227d5681b1540979620cc56786f6d10ba0016e9735a30602f1 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis.html 6ea7d0c811fe93453d7d5d244d940061e737585fbbc9ec8009f7a6e449534476 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_server_l1.html de02a592358fc08518ae8dcd622b82d85b1c6ef45088a49520871051ec284cea 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l1.html 389e97264b04421cb6e078fa7db8dab12f9e96b1d70d3f09e2757141532d79f9 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l2.html 2b4c35806943ca1628d05239031c702421ca154feca2479489cea7b4615fa38d 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cjis.html 4a1a1b293fecbadfac2380390a06f6c5acfaaadfff84f8b2f1c494164599ff5f 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cui.html c85b4addbcf2009e713d00a902c20ec5fc929a5566990db9750232f87f864c85 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-e8.html 1c91bc75ad3800f907d24bdd293cde663523ca4008f00e3cb14ea5550e64cdf6 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-hipaa.html 6491c6409da9d077978e497775eef95037f075669f1ec3e19384950e844f557d 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-moderate.html 85b5bcae587c9d299c601eccec40de078221f41db14c3d836a34f54816313da7 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-nerc-cip.html 1ce8cecf2e30675f085fa86b254c9ff8ca76694fac3385d66ffce4de775fde5e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-C2S.html bd0fca8c42a1a324147053abd57632bfa66349bc843b46c35e162b35ca8e45d2 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_enhanced.html cc55b7950c930c064af7e2487eeabf6f5f11faa18b197443e8b336b199726cac 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_high.html 32143e7bf7e604f8bc07151dac90aafcade29c448f3e8019105a4b6c9cbf72fc 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_intermediary.html b18749778bf62a884c9f3a40654e33557956947933d39f1f2d75a80292ad166b 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_minimal.html 312b954d4dd663ac59f720a7a9e923c323da46202284974dd53546aec50d8036 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis.html e0f32e06908512083bb12d8090b3ad4122d4526dd10148ad25b815801415aaf1 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_server_l1.html 4a51cc89e9c04651e4bc75bbb89d04b478e00905eea2acc7aa8c209dbbbbe247 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l1.html 8ef0f2fa5f9bfce4c6777ca927c5f4c53d5f412a834d3db38fbc2f42cf41d665 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l2.html 087c631535b3443d32ff3e28814bdc5c7db9a931ecd984139d35362f30731560 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cjis.html 60a2a36b92fa0b7d625a7fce205369b6e2a46a6c2094815a5bce2cf9ab76bd16 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cui.html c9702359df58804982e51e85af88549f4c5107515fdbf6b20c1f1dfd38ea70c9 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-e8.html bc32a924176a3307be58c096cf785d2377ab03bf7eebeced8f6d3ae253a83bcb 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-hipaa.html 876257a75e4c8d32420f65deb483c459a6985248b6a302ce72231a6fc5151686 2
@@ -834,21 +834,21 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ncp.html 0636561a89df2cebe963eb8764f5ff715205b62a17bda30521f4ed27bd394430 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ospp.html 718b7407764e132919fa47153166123d57e1bdbd48632fb52b84f88c02c18acc 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-pci-dss.html 13f34163392933d92cdde4159b2831ef3264ea92e52ba9cd924c1fbc9c66fece 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-stig.html f433e92c38fce4c2629d1e860634d56ff0fdb183614cec29a4776b65a14d225a 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-vpp.html 79a6e00967098a60711981d0c68628a5e461e38ef2fe6f8c8b390fa33b9adaff 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rht-ccp.html 29f811c4d0e830ea24d68ff77b4bda7f467c2f0f3338f73cdac795b987bbe386 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-standard.html e7cb46700c71d6fa590a4cb70045d9f488d42a144a7a44606a4debebae715f15 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig.html ead745fe9b987367d33f9cb78abb9f8fd99cf908398be2f15f97b7a7680e95d0 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig_gui.html 215b2dbe612b46ca1cd984a02c08967f24d5ac356f169e866cb17bbfac987386 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_enhanced.html 7f6e43dbb54cf0e5bad5cc1eb17d3f659220eba7bc29667c2f23de6d720405e2 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_high.html e7a89bdbf5a139e4a71e1eee6c9fe399f73a58dac7676ce57707f4e85d801df1 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_intermediary.html b85f765ec87e515e83dc44bae56d0e7e4235f9b7ad13fafbbe0fc898780e8b25 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_minimal.html 04f46704806bac71e2c914bbfa9e51608e2a623d0eb00ff664cbe82df4ddbcb5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis.html 4da18e2c6d81efd9903c0b753927fd6ba0e30377f70cc8783e450a7efcaebd21 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_server_l1.html c4bc4ba16dcf97ee524fbafed7fe8edbd42634cc503b0de71615cc494ef4cea7 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l1.html c67a4faa55f4aa32ce81d0c5097a7e8f644f7a332eb09e02133602bacc197cfb 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l2.html 3550d8d5de0501db909204e5705c9b59596a8f84e4368677ab9f1e89ca1922ff 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cjis.html f1884bda1eef211bb954ba9e6816256725ec0a738d27c7e183a7ed1ce1800e8b 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cui.html 1208393f3ed074c7154c1d5fad639f6c88856fad9f28270d3b56893db64bc99f 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-e8.html 4393143202358d3494592179410db36c852ab81dbccf9cf8519bd014325c4f09 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-hipaa.html f94afdf1fc32f5ce8f44de1d4d284848152c0e7b20f2b2253591172393714ae9 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ncp.html 1ee68b4894e30b4c4cfc825275e5138fe204e91623197d13a6379c5def22e1c9 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ospp.html ef14ed72608a740ab2e42cd59a2e66ad1232728ffa72e68033f0d37c9782d266 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-pci-dss.html cd5eea9acb94cf63796b4681e302688911ed1ffcdd32c97bd4498452498ea26e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-stig.html 936eea57f9a7e51299ebeef68b7551c4c8679898edf8578ef4030632ed075cf2 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-vpp.html a570049adb821da33a50cebe1854ca756cd995cba3cea8ae1227d83ee02829bf 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rht-ccp.html 21671d2f06735a902c7971f65fac2eb730d89ddabfaca09b7d3e831810e79bd0 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-standard.html b20e1620bc7c40b47482ccdab29b34124023e8ac02bb4811379df9d2313ee11e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig.html 9b6bfd5dfa2edf4000cdc524b3ac177be2b44108fefff1d0f2cc6f1f8ded2b24 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig_gui.html a1b4b133ae70c25c5af1e702f77668efcad0454be9cf31908a2277c5419cad6a 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_enhanced.html 8c20ccfd81ab8d34cd13adfaffcbe6d8b1a9a70f764d9ac80bdfb8f30fb7597d 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_high.html 93f76920c7f92a2bcff9d1b422efa9393cf83347ff3f8ab0fe192371f3185802 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_intermediary.html 94e351e6c62fc07adad1b1cc53338c4a003443575b1cfeba6e35a28e55ba4aa5 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_minimal.html e39af79e55b48fd9a105ce484aba5bff0389716291471a1b167542732238f231 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis.html 5a88f4e2c5713797e146c581b95cf2d8171d2462ed99f8e93c9d0b891e7b865d 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_server_l1.html 3573acfb9f3857fe474978ea9d2e2512d74b52501a9d73657747980074bb8111 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l1.html c4c3a257022371a32d6e09d4c50132e299c0e7cc9412c025bfcf11d6af2d95d0 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l2.html 73cd1e6a09ccf0c57413d0df733e3a0ec782f25e2ddda99d2ddd16e63bbbd3a2 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cjis.html 975547dd413d7a635449e325889fd4287a66912f4565215e243467dba96e00a5 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cui.html a33b3edaae6481229d8f21bb81ed92020078f93c6357071ae248f2833ff8f849 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-e8.html 662cb06e27e88f16ba8a7139ff9d3073ae7d9a2390b5c3847e7b39c4a1cb14c5 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-hipaa.html c7243e961bfcb1dc7f3728eead098f80bc10ad1717f0bfc28e0b2e46d30bb6bd 2
@@ -856,18 +856,18 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ism_o.html 5aacc4dc8d69ff73af5e17115baf17826800b2f31d7812fcc2bc12883791b5f5 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ospp.html d6f84c154e7969ee443c7f6c8152666315a2968f35327b827fa2b54bd034feec 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-pci-dss.html 3d9cec3dbeed844e121a7518cd8f4950c37face709415302a3eec1413df7f4d0 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-rht-ccp.html 924154ff0cef3f0fa43b405751dbe2109ae89737103240dbda9451b5be02ca81 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-standard.html 24626a11f693a22b5b1cffb2d489db917b81639b4ec454ff2cb11a5c9e385b20 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig.html 2eac1dafe72b79d30122b23f3858f03b7b8a2df6271fa82d4695e36e590847c3 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig_gui.html 8fd1ef5da8e6cd666f4ee44d0b2f895f5ddf97b4c760a914e4a7fa0c50be6c1a 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_enhanced.html f89ac634d31c1f7d8b3f5fed20f76e3e9f3159105fea6c57498ab26378064f89 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_high.html b6d807250507de8b561339943a3a850636c541a315020809e911fcbb9d90804b 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_intermediary.html ba4051c457e991b59b0034345c14e574802b8d134e4779aafa3ff8c3e71d3484 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_minimal.html 651a7c79ed0c730d8448d58d7a306cb6d798b92f12ec931361524a50ba1576cc 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis.html 2576cbfabe9d6a52113ed178a5854e96258f59b702be4a44d858b997e772c0c1 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_server_l1.html 66321b778367e736f4fc36508934b39d5b7000979afdb264cb434dc3a8d21053 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l1.html aa12f7e49ebe6f7e83a52e0ecc111fc0c98131b3aee643f82a29837f9b219c32 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l2.html 6df3c3d92fb765a9d1cf3ccef51fd885734758d5fa0f0ecf780cb269e291f0ff 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cui.html a1ce12f04a9c502b4e78ee2457cefbbf7895dca3fefaaa52373d66e6b3e52070 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-e8.html 1e71f6140ef35c9ec9d67a240bf44dc172a3cc4d1f886ffd36c11e83ad3fd0e0 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-hipaa.html 9bb31350ab6a1eb2b30cfbdde1f0f8cc69674279e71abaf24358da76917a82a6 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ism_o.html d069db10f3578a656e13c411166c9e6ec9d82b4d06484d764f26da69d5887ede 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ospp.html 86fcdf7bc171769810417ff6c9f7f7bc45eca7cce2d80f385271ad92b74a9afd 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-pci-dss.html ee5f34922788328e752ba287470ed48aacb2343f866670b9f70a852650f30c09 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-rht-ccp.html 81c01bcf6b151168e8f6d4e27969efdf36ebd9fbc0253bbc87b4a2715cc2ddc6 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-standard.html cd9244e5cf29ad08c7235a4c8ecbc4b7bb890c270e95f5e3c4a8e9dd9515a393 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig.html 3ec63f9f1cee4e430aef5c307713cdcfe0ec9682f378153ff3bfd8437d46b6a5 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig_gui.html aaa41e90ec731932a72734d6e676cdc1fd60e73d584f258df9af6f4af1ab0e65 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_enhanced.html 2f0a4be875cb749c3881c744d0dab50eff567a4ea47cdc7442d0ee9c86a915e2 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_high.html c8ba1d1fddde7b8b8f9d9d0b517633c5b0b34a8fb02d811d0dc1cf91586f0a01 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_intermediary.html 326bd77a1db999866cc254ecc0b8b00a7f3b5f4a1a25b2b836480c61ea7c5257 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_minimal.html 06022f858d7834d67d3ef83e1d00367db6256f1c46433829b986df68db40e68c 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis.html f18212fc3601002fbaad00dcb25ca8e3f52581d7d1f0639b51aa6adee5f62c1f 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_server_l1.html 4086c738561aa1c63c1fad14d5cacbc13d8d608a08497fb9062711f8d4e6b519 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l1.html a64116952f885c65458a01ef13ea1f50b48bf9d55bc6f02ed07af169bb6fad4e 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l2.html 995bc2788756d0b86b4328988baffb29fada82b67df116d0024bca6c0b327681 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cui.html 496ee47213fb836538dcf04ee4a304d2c4da43a5ec1b1b5922d2b655b5c5e4aa 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-e8.html 23f614feb04617a4ee74f5e72a464213cc4efb81d37821bbf556d260ffbcf3ba 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-hipaa.html 877c4b9e05eca4142e1d4d04e32e55d35e274819c8d662f0b6d68ec3c4b01484 2
@@ -875,5 +875,5 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ism_o.html 0fcc16b2d22170d7b18b3d33d7cdad9df47995e35e01f0476b86ae19eab27ba6 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ospp.html 7ba25edc9a57ab667424bcf3b04fa80079c0edcabb651626026891306ae0aaa3 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-pci-dss.html 4a24fb69532090cfb952d274ac003f34eadd16291ed02d4be2ee8e5fcc3cd242 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig.html c182467809ff97b9b6428830951d482418d47028ceb9dbb45a0855ce83fe6eb8 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig_gui.html 0f400213ecbc52ff3215c03337b824fbdcd13430a0732d0c0ddb31457f7380e7 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ism_o.html f359342148e85400c1450ccdc3979fa128ee04a977d764a65446f1a3c60dbf97 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ospp.html 46cfdaccbe39c2d393c8482261aa96473f5e0eb9bfd0c3d2306134ffc01cb0e3 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-pci-dss.html ec10f52eca34b9eafddef64d9721a49f14398cd63fbadb751e9f0e2224d31388 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig.html 854632b5786769c1c593392dabc6c62e244f7c0ec56adb936c7cb44515546f68 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig_gui.html aecb0abf25e7c7289f67e8f4bd372786439f355c23f8e42d913862cf492061a1 2
@@ -881,3 +881,3 @@
-/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-pci-dss.html 357427dff250b119136112fd67d70a7818a2f53cea38cbb67a1cf417bb6b1838 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-stig.html ba03e6fb66f079241a1e413050c12478473f5cd9e332fc61006e65126589f7af 2
-/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-vpp.html 3b0f86bebbe947d6656797eb655f41243bf2bd60b2e7700a83c072dd5c549b4f 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-pci-dss.html a441a03d4c6f11baaa073985bc1f1a05ca68e528001a41760c58a6fcf8c011f3 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-stig.html 5357e1812870aed81787fb1e1b0d0727299be62867c775eed40e690b88999204 2
+/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-vpp.html 19d2a8fa83a85d814ab887475e8d58a988d78ff0077c5204dc139d433596988c 2
@@ -885,2 +885,2 @@
-/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-pci-dss.html 429dd1f713ff04838af1b05f50be0e7b3b485ed9bfb1877c6fd55198c0d03c0f 2
-/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-standard.html 1ae5b83cb7551bc9818d40f9fd989583689a2a7a0f87da1a487158dc0d268c28 2
+/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-pci-dss.html 19347d7f70d55526abff97f3e0b747cfa72ad30614c8bbe33fece9adbc7db4c9 2
+/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-standard.html dc86437a3a1fab9b43ea20cc1efc4335306f9fb9c07ab888e52a98b3b52c68e1 2
@@ -888,2 +888,2 @@
-/usr/share/doc/scap-security-guide/tables/table-ol7-anssirefs.html c91969aed18cfe142a29bf42a9e7dc9f0dcf7a2a5394ca0cfc2f67c7f2b8316a 2
-/usr/share/doc/scap-security-guide/tables/table-ol7-cuirefs.html 59658136136b3ce8144637e174692660335eeb2389ce820e095a5a739cb2ac26 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-anssirefs.html 0bdc3409bc387f0658276efa5ea8a11a1dcec61e65ebd49fe727aac7d3e32e00 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-cuirefs.html 256a6570e50c4fc6c10d937b7a8a9add9dd84ca2427f85f9931fc88544d72431 2
@@ -893,3 +893,3 @@
-/usr/share/doc/scap-security-guide/tables/table-ol7-nistrefs.html 5e956b4de9ba81f39f3bd5cddeaf78d4517e388364ed539568b27812bf4a45f1 2
-/usr/share/doc/scap-security-guide/tables/table-ol7-ospprefs.html da0c6e94dc0a5714c85c9ad82cf72c34e5e66237aa7d1b6b22508ed5a4352723 2
-/usr/share/doc/scap-security-guide/tables/table-ol7-pcidssrefs.html ebdad414acc97cee23cf8668b2f37ebd948e783ab0e3f4decb92a1fc6fd2c5a6 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-nistrefs.html c478147fa8915714e6cdb13a328c631b8e1dfeba657239d552aaaa115d66130e 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-ospprefs.html 1b8ca029e349772bf6a1d13a949ea0670ef8baecc65216fcc74aaea40638a2f2 2
+/usr/share/doc/scap-security-guide/tables/table-ol7-pcidssrefs.html 43111911d912c5e07105c8977c6539a327d12a4e2cf8193684febbb54b82972a 2
@@ -899,2 +899,2 @@
-/usr/share/doc/scap-security-guide/tables/table-ol8-anssirefs.html ed8bd8a03feae7ee952bebb584ccceb2b0e1ac7941b98efff9c6e8c4d67e1c6f 2
-/usr/share/doc/scap-security-guide/tables/table-ol8-cuirefs.html 7c25b74602b3f06d038e4e63c9acad54ef9da3f4fcfcda5ff0d17258815f485c 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-anssirefs.html 17e533cbe812a46b01e4dfeba2b560fa4d3dcf05607d2c538372df57ca67ba50 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-cuirefs.html 1889b728ab12a67ec4cf1e097421b82bc23a8ea8be7318f9f2ed1fdda72e55a8 2
@@ -904,2 +904,2 @@
-/usr/share/doc/scap-security-guide/tables/table-ol8-nistrefs.html 2c24c3d7c56de2fdf1a61b3ed9d9aace1fcb8fd00a395cc9e70b4fe7d2752c5d 2
-/usr/share/doc/scap-security-guide/tables/table-ol8-pcidssrefs.html e4e7626429d594276c1bd486a0d4678b16dfa23fa2d3d77c83ffddc9edefbaa4 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-nistrefs.html 2a8b398123b1d8f31720cb8b0d5c4b80b6b6115fb730db4ee95eb8829c4e455e 2
+/usr/share/doc/scap-security-guide/tables/table-ol8-pcidssrefs.html 0c234649d45beba2306a2fddcbfb4832dc94e45599640fedd95f99d611033367 2
@@ -910 +910 @@
-/usr/share/doc/scap-security-guide/tables/table-rhcos4-nistrefs.html 8dd6fd200fba2b3af54d9c75c02511881d07140605087510bde47124fa235786 2
+/usr/share/doc/scap-security-guide/tables/table-rhcos4-nistrefs.html 9fb001f49018fc4c28ac7e8110af8d6812d6b8adb5e31e4944e18200718f122c 2
@@ -915 +915 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel7-anssirefs.html 50fa03498ddd32dc45aca71e92228399904ed432e8aaee5282b695dac8d06784 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-anssirefs.html b91e15da2e1d27972f538affec88d1858ddee186e94a8e40ff4f2d1b0fd65aaf 2
@@ -917,2 +917,2 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel7-cisrefs.html a52fc848823de7083d42654f2f3c8cf0b2963acf53c5029a39d466d415499b6f 2
-/usr/share/doc/scap-security-guide/tables/table-rhel7-cuirefs.html 74e5ffd7a33210504c81581cafe32138ed359c5a854e0c8c5832c5fd1cdabbaa 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-cisrefs.html b3787cb09c17a87ba00620088c0b265baaddde8b807d2393cbcd0c9a68913e28 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-cuirefs.html 48a177b464c493dbdd4827f57b74f2f6c925fcd0072ce03ba545f46c0c21b341 2
@@ -923,3 +923,3 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel7-nistrefs.html 27b88e6f5be41d3248f306fefe0929e648215c530f9b62f47fe9486f6ee30774 2
-/usr/share/doc/scap-security-guide/tables/table-rhel7-ospprefs.html 115e519e929f9969c4e03a661da8c4af062c66fdb72ba407f870b2c1fe9a95ca 2
-/usr/share/doc/scap-security-guide/tables/table-rhel7-pcidssrefs.html 9a429d03e0ead13900d8e7cfdedd86f669ebdb5101833329be79099da28dd330 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-nistrefs.html 005aa25e3569880d0994e01dd20371effb353071006dc39109baf15d7d496322 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-ospprefs.html f4f6b6f3d9e74664ee32b108e6c6a86869349a6c1988e34eaa034c1d4d2d9f72 2
+/usr/share/doc/scap-security-guide/tables/table-rhel7-pcidssrefs.html fd7f645a471645abab76ad3bd3fba7d40de1b819427c6079dea29dd0b64cb1e9 2
@@ -935 +935 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel8-anssirefs.html 0c19c2bba7becdc53c2730a09d527975c5e18e1e610e62fef8371398447e66e6 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-anssirefs.html 2850755428a4f50d761a4a48c7c242dd39a643e635fb44027fdff83e7d6f9674 2
@@ -937,2 +937,2 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel8-cisrefs.html 67e430898c1825ff2f91cf55b84da28e071d35ced7f1f9187d82a342047d9d69 2
-/usr/share/doc/scap-security-guide/tables/table-rhel8-cuirefs.html 5dd4f8723839f2ada928166fa0c14684a9956fbfb6ec32bce71e464d9d881403 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-cisrefs.html 80fc710cd4928ffb7dcd145a2d70eb2cd85b91b39837c25200cc43bdbc06886b 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-cuirefs.html 942ad8b1dff8e2d5b677684e4a706a6e474b24df04562b7205e9db549eff2c5d 2
@@ -942,2 +942,2 @@
-/usr/share/doc/scap-security-guide/tables/table-rhel8-nistrefs.html 2a0105cbfb0f89a6028708fd80b15fd58ef6a9bd2197260c5b3221904cc798e7 2
-/usr/share/doc/scap-security-guide/tables/table-rhel8-pcidssrefs.html 385955cc0d1d7006ef238fb0ca623615e26185c380c3f696dff55ad613e7e063 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-nistrefs.html c67c485a8c9e3a159e7406ba1f87d6dfe90036b265b3f8dc5f720bee8e7d64b7 2
+/usr/share/doc/scap-security-guide/tables/table-rhel8-pcidssrefs.html 41bf5f787b87518ac64868128988addcd52907bdf0fbe2c8498871181ed12f8e 2
@@ -1285,2 +1285,2 @@
-/usr/share/scap-security-guide/tailoring/rhel7_stig_delta_tailoring.xml 7874b849ec07c8646ef70d5091bb4ccb4efc45ae3d802c932f43c0fbf30526df 0
-/usr/share/scap-security-guide/tailoring/rhel8_stig_delta_tailoring.xml e36c305784932effa4f2746218e5a6fc3638ed8a1671d7fee3133c585c399d7c 0
+/usr/share/scap-security-guide/tailoring/rhel7_stig_delta_tailoring.xml a3365b664cc7af97d727764070c17dc40c85c725e7eea10a22ebba1ac1ea2cb5 0
+/usr/share/scap-security-guide/tailoring/rhel8_stig_delta_tailoring.xml 4e61c9b5ff5a828c20fd0cc29674fcc9d4ee91f64d08ab23158289fbe676f940 0
@@ -1290,9 +1290,9 @@
-/usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml 93c45632790fc347ffcdc26397e64a35b6efc2eda1ec8ac8d74caaf911c1c2fc 0
-/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml 21cccf90cdb1b76ccea2d16e48134901a90bee84a63235826fa3a839415d498d 0
-/usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml 2a3d5c69896d1c148e0e35afb5fa6dd59d770eb93af9313ef2004a8467aa3873 0
-/usr/share/xml/scap/ssg/content/ssg-centos8-ds-1.2.xml 75369753c41f65fcf8ba56209fa86d20ba2afa445bf694d01483a92b6e33c4b4 0
-/usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml 518c4fac88c5dbb71916edcd88cb205754dc5c18c5afaa1d198e411e119ba8f2 0
-/usr/share/xml/scap/ssg/content/ssg-centos8-xccdf.xml d37bef3e78bf02bfd7fd947a8949c555522749e6d205422a173b8218ea4e67f4 0
-/usr/share/xml/scap/ssg/content/ssg-cs9-ds-1.2.xml c4a684747b64f66c960d1fd602b18e7d811bc5dbd56036891877c4b5e96f139a 0
-/usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml a31b102c4a8e664f2fdbe77028d12bb7b99e0c84bdb1dc8e3eccaa8659fd75b0 0
-/usr/share/xml/scap/ssg/content/ssg-cs9-xccdf.xml 5f008bfdf702d910fa342545c5812e617b6e24d8dcc87b0722f2f2be69aacff4 0
+/usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml b4b34911342cc00adceb917674216a6bcab23a1e64ece5a5174b7cea035072f4 0
+/usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml a782f45c87e979766455575899d19eee571a425ac23d69c2fa858b97b0b6fe6b 0
+/usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml 28a081c2e2695e00d64ec5aacd0f6a2f7401355f94b955d3eca9cb8f142b144d 0
+/usr/share/xml/scap/ssg/content/ssg-centos8-ds-1.2.xml 280297439293b28d3e9b53750d0fee254f9067f9d2673948599cda8ba203b0f1 0
+/usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml e73c0e7fa0bf7011e4382492acb2428fda60c2d021ad493dacb3c2f045fa6347 0
+/usr/share/xml/scap/ssg/content/ssg-centos8-xccdf.xml da4d5444e4df443ebff3572654236eb14203e34224020abd412e293c2c4ec5bd 0
+/usr/share/xml/scap/ssg/content/ssg-cs9-ds-1.2.xml 2f98e7145d3cafa50f428bcf9643df5e984a94104caf72a43c568461ecbee1e3 0
+/usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml a716457bdd58f64bdebc1291034b81fd8826c4a8df87951c88255dc8b5691ff5 0
+/usr/share/xml/scap/ssg/content/ssg-cs9-xccdf.xml 507750ea19f7e3940d942fbf46a0563434956f98c56329e9013c55042f140461 0
@@ -1301,3 +1301,3 @@
-/usr/share/xml/scap/ssg/content/ssg-fedora-ds-1.2.xml 70f160038ffd5448e8621f63081f55274dcb95b686e4795d88118b7e6f31fd66 0
-/usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml 17fb378699a2687b34d3ddc2b014596c5bf8ca6faffeeb76bc4c9ba3f37ef1e2 0
-/usr/share/xml/scap/ssg/content/ssg-fedora-ocil.xml bf1a552a0d9412160e5c252844e1553937627661ce07763f560825cc1dd51869 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-ds-1.2.xml 747133421a1a17262efcff2b06ad737df005b877de85efaf0b961248a9b7c0ab 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml dbc1c2661dddf726771f04ed1d9f0a045b65c4072b9e3d3e6b04986a472bd1d1 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-ocil.xml 8ad2c5fb57147bbe0c97596e6916d6f3c1a9e85d83a49871ca6c82ae0b039203 0
@@ -1305 +1305 @@
-/usr/share/xml/scap/ssg/content/ssg-fedora-xccdf.xml b680c2e3dfe5a3ef1ef4b03e5589b42dac63c08b039423cd061a3efcadf21db6 0
+/usr/share/xml/scap/ssg/content/ssg-fedora-xccdf.xml 529b9fb7d3ac94777b48fe4e109f03eff0e7957fcb14e8c428ab2d88cd9b9ce9 0
@@ -1308,3 +1308,3 @@
-/usr/share/xml/scap/ssg/content/ssg-ol7-ds-1.2.xml 8573d1e785ef9be115edbe644721cc343ab592cf8daa0718780ae570865c6945 0
-/usr/share/xml/scap/ssg/content/ssg-ol7-ds.xml 171470bdabc34a0acb203cce8010aa91e50622c0b39e410aa1acfa3309c75fa6 0
-/usr/share/xml/scap/ssg/content/ssg-ol7-ocil.xml f9c77948cc4014648bd95adbec6921358aa67d1627ed80d115954898254615cf 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-ds-1.2.xml fe8e31b4cab87b04e77d1da58cd078e45f8e56476fe4c1cdca252924b8225962 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-ds.xml 2fc3682e6c6848adbe5a53dcbf1869945c43551f2e3a367eb554b226502bdc7d 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-ocil.xml cff55d7fe0e35b7e638bd0038160d38d884845d27a9400de74a13d91dbb3e87f 0
@@ -1312 +1312 @@
-/usr/share/xml/scap/ssg/content/ssg-ol7-xccdf.xml 05859224259a10824232d1b241789fc641b929f1daab93381e3ed1b7160a0d22 0
+/usr/share/xml/scap/ssg/content/ssg-ol7-xccdf.xml abef31fe6f62f78af99b0d550496cbadab068df7da9dc7e0573c05880f60f0f2 0
@@ -1315,3 +1315,3 @@
-/usr/share/xml/scap/ssg/content/ssg-ol8-ds-1.2.xml 4f8cb39c092cca61350bcb909291ed966948cc6a7da3f8e0b63b5a5a180201b4 0
-/usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml 6ce82c8ca6777bb3f8169bc2858c4eba9ddc3e5dd9455aac99d74ecbbdfb7b5e 0
-/usr/share/xml/scap/ssg/content/ssg-ol8-ocil.xml 6c0091f921eb5a71d66bca41d7561192127746aab309ee718a2632e6bf0a5490 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-ds-1.2.xml bb62b1c06d4bc0baa38d9d9987a831e607d98564c6154fde4570b519a97cc0e1 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml b0aa117f4dc7b7dd58b85681f9c41bc244532ce89ff437b5562aa75fafb93008 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-ocil.xml bfea5bcd9d114b608d05d8fba51ff498bb5e6c646587e401ed736b1f1faa1cc4 0
@@ -1319 +1319 @@
-/usr/share/xml/scap/ssg/content/ssg-ol8-xccdf.xml b65ecddc2e7a89111b2aedba96e1064c92d0c71595a8e4bfb141af60e789ddff 0
+/usr/share/xml/scap/ssg/content/ssg-ol8-xccdf.xml f9379a3717e6a786f74ab33dbd927e25d3dff948c53f0163086fac5dc3bddb7b 0
@@ -1322,3 +1322,3 @@
-/usr/share/xml/scap/ssg/content/ssg-ol9-ds-1.2.xml 044a2290e71447406fecde09a0324759fed54324ed416100b51285508448224d 0
-/usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml 076a8abd3ab0fd7593b3b0e235d75c7ea385391852c17181c51a6c769e2f343d 0
-/usr/share/xml/scap/ssg/content/ssg-ol9-ocil.xml b2793035e0c255d72ed0d917fa84ed2194b4822bf96cde12e4480984e5cd2af0 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-ds-1.2.xml ed20b088a32b29662e8c7e38acb2a4b08f293ab0830bc8598eedb7806f327003 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml ef6b66294eaa397114682b7514bf63017d85d669794f43874567b4f296e94299 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-ocil.xml 23976527697abe71ee8a97dc7c4e860ace5d41899f8e73f5eb3052b9c9ac2ff4 0
@@ -1326 +1326 @@
-/usr/share/xml/scap/ssg/content/ssg-ol9-xccdf.xml 477188ee2aaa735f3bcb6b3b0a8adb4f399d002c46df7c99e6bfecac9474a68e 0
+/usr/share/xml/scap/ssg/content/ssg-ol9-xccdf.xml f1c1e678663b592ccd3f3d1ce550fbe24d04cf9debc990f7c20f4ab3d6e165c8 0
@@ -1329,3 +1329,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds-1.2.xml 62ffad050f0040700fe6b93145c1bf5e844867b4513f37f27d2da86a2b810241 0
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds.xml 7af0dc6732ce2c9b737eb91918506186f0a4ae8b14f1312c82452b96c8bddbe0 0
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-ocil.xml cdf03d6267d88e2357cdd03d73445599a09834db15a6b808292e0bb07ada7066 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds-1.2.xml 054f70875f2a7ee7e742aa0aaf441db4fa1ebbb5465429b67fa6e49099051c73 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-ds.xml 7de2051dfd676d1c97dc3a51198b1f194f3ff36d61804e71ac8a8649bcad1242 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-ocil.xml 6a011d91154be38752a3d564379d79ccbdbd7a820adac4de6b54245aae323639 0
@@ -1333 +1333 @@
-/usr/share/xml/scap/ssg/content/ssg-rhcos4-xccdf.xml 5394f3e587a744615be15851fa456af4d9093db6d0040f2f6ad68ad4fe9e5bda 0
+/usr/share/xml/scap/ssg/content/ssg-rhcos4-xccdf.xml 6e0ff7496a3d9730473dbab008b40ad9bdf67e408592178d195b71a1a4f50d96 0
@@ -1336,3 +1336,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml 9a4f1ae2e0217ded4570a36d861d30441c551db65fd3f7f23dea59dad7f7ff2b 0
-/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml becc19db1f308940a4e5dc7ccd9222d1dea9ae90642ed9e10b1e00a932e2790e 0
-/usr/share/xml/scap/ssg/content/ssg-rhel7-ocil.xml 4b76f3245657d2437d40d561a9f00d277fbb55d2902f57d052149d3b89a19d15 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml 7c795db134dc84ff1decf3dcd0c780f827e0be01765c57d70d8e0c1d0c6b098c 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml 6ed83ea20b70fdc2155b979fb2849d37c21877b089d5c95f40ebc896e8a51b59 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-ocil.xml 5e315bd206e3ae2873e3b731458fab746f3a85859af7c8b0c59743db833970f1 0
@@ -1340 +1340 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml cef1ee279ce29b969746b2416c0d42177699bcda5291c5b360408ae99f7e8a1a 0
+/usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml 21e45531a31e586a8d5c84f4417f9946448b7b2665c27715b327abd07c4e7869 0
@@ -1343,3 +1343,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml 41ca8101170129991b3e5f8c279651b872f49ca4d7692e9dc8689429de6eea15 0
-/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml d6b162e0a332f8fc2c7b87786966ca51ed709b41e299dca880a41e039d40bce1 0
-/usr/share/xml/scap/ssg/content/ssg-rhel8-ocil.xml ae8c62822ea5c768f7faa155ca23f0a84f3eb43d09e268b47a18a2db3ff25787 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml b261f4669f2ad0e0fae53c25bcc26bef9ee948104aa865846f7c07ca28a1b57e 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 7b4a6326bb98619dd50e492d4c050f4ba0d975ca0e1ce5010e8ba839d73eeb14 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-ocil.xml fd0052d5bd63ddcf28bbbbece9c41bc49e21cdbb6c969681a774da5f3b906f45 0
@@ -1347 +1347 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml 4245a30d614429172e73bba9e796b87eed3a6dcc6828d7b3ed169bafe404ecb5 0
+/usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml 723045c6a811dfb581fcb4585bbc4b1533e00eeba1e2f9ddbf0818e8006b1f8a 0
@@ -1350,3 +1350,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml d4afb4abaaabf8e6e81243b8d1dfac20172c96f82b58eb6741c0cd29ea4c24f0 0
-/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml 2b69ac0d0b3cce10358ab1d491f31267c0b3b0a6fc5350a70ef2d31ff0aeca5c 0
-/usr/share/xml/scap/ssg/content/ssg-rhel9-ocil.xml e118a6cb402bfc6dc9f87b76d734681e3dba3181a8ef2839fe171982de55f384 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml ea9fdb65ba2188c1f63ce07544f997d35681b3dbf6e09ef729d163448c630359 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml d4b0a74aea6d4255242363c013ddb529cf6d373c09145843b846da8f4f74bf9d 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-ocil.xml 5cecf5564e664b06456c7d1589c7c0920ac2d1267053e045b22cca6e5126be8e 0
@@ -1354 +1354 @@
-/usr/share/xml/scap/ssg/content/ssg-rhel9-xccdf.xml e3dbdd5af6a11c5a1ad4d8aeb070ebfae6e8b8273c281c7466864aefe1ef347e 0
+/usr/share/xml/scap/ssg/content/ssg-rhel9-xccdf.xml 3748fbeb1253d66b833e8a62098415d07996b74fe252cceca23f947d53611112 0
@@ -1357,3 +1357,3 @@
-/usr/share/xml/scap/ssg/content/ssg-rhv4-ds-1.2.xml f853eb3dea2d2496da493f0b8b686b172e14b20123e4a2620b5c59f125ab2b03 0
-/usr/share/xml/scap/ssg/content/ssg-rhv4-ds.xml cd79984a71f3f8694ee18b1ae457fcb20d53fbe822259a2d667be40c99e65e7b 0
-/usr/share/xml/scap/ssg/content/ssg-rhv4-ocil.xml e474464e72abadfcab6b52028865a508682b267afc93fe9504a301ef23b6a066 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-ds-1.2.xml 1204247e8f1366de0ae1cd9c7321845e62aa18048a4f0c8b22247945c51dea73 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-ds.xml ce2be8be26762c82d1f75ac01488be44aaa4b094b6b3fd20edbf90e4be666d53 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-ocil.xml 91da5c34d0ac687f0fe9e708a17985f231a6e84b57e07da373de86c3545737b2 0
@@ -1361,4 +1361,4 @@
-/usr/share/xml/scap/ssg/content/ssg-rhv4-xccdf.xml d25b3ec45aa2d88c5513b2c13087ea7233233ec1866f8f1fd3308245da2c5420 0
-/usr/share/xml/scap/ssg/content/ssg-sl7-ds-1.2.xml 081d8d81a495e5885d375248978dd4aa2f1c393063df7246098d577f3524e254 0
-/usr/share/xml/scap/ssg/content/ssg-sl7-ds.xml 863f23502ee1565a9366360a5d74cc87bd3801e183673f6a7d4797ac4674f8a9 0
-/usr/share/xml/scap/ssg/content/ssg-sl7-xccdf.xml b1fd01b16ec4a9357de024cda21b81b26f92bec12b32f81fa035daea263af303 0
+/usr/share/xml/scap/ssg/content/ssg-rhv4-xccdf.xml e1925d6e0f5bc4886f56acabb83a28b76b5919f386868289d0cc43441192b825 0
+/usr/share/xml/scap/ssg/content/ssg-sl7-ds-1.2.xml fb0477c0a61d1f7789ad96c768358033a2e3b3b9d4d11e524260eafffc736e82 0
+/usr/share/xml/scap/ssg/content/ssg-sl7-ds.xml 8c15903b2b58d03e6d38921e68558279f0b5f417aa565fe2e1ec6ba786c9ece9 0
+/usr/share/xml/scap/ssg/content/ssg-sl7-xccdf.xml 75c95413cf6eea871ec91e3f65f6c01094e2e87c9e07c6ca0dd02728cfe2f14c 0
comparing rpmtags
comparing RELEASE
comparing PROVIDES
comparing scripts
comparing filelist
comparing file checksum
creating rename script
RPM file checksum differs.
Extracting packages
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 47 groups and 96 rules
Group   @@ -431,14 +431,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -448,12 +441,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -6175,26 +6175,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -6231,7 +6212,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -6349,6 +6330,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   System Accounting with auditd   Group contains 9 groups and 41 rules
[ref]   @@ -18085,21 +18085,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -18439,7 +18425,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -18757,6 +18743,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -18780,21 +18780,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -19122,7 +19108,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -19433,6 +19419,20 @@
   - medium_severity
   - no_reboot_needed
/usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos7-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:centos:centos:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 28 groups and 51 rules
Group   @@ -850,26 +850,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -906,7 +887,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1024,6 +1005,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 1 rule
[ref]   @@ -12400,21 +12400,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -12754,7 +12740,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -13072,6 +13058,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -13095,21 +13095,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -13437,7 +13423,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -13748,6 +13734,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
+        overwrite: true

Rule   Record attempts to alter time through settimeofday   [ref]

If the auditd daemon is configured to use the @@ -13771,21 +13771,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20settimeofday%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20settimeofday%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-settimeofday.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 61 groups and 171 rules
Group   @@ -124,14 +124,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -141,12 +134,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -449,14 +449,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -466,12 +459,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1031,23 +1031,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7320,21 +7320,7 @@
 authentication to privileged accounts. Users will first login, then escalate
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7342,7 +7328,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7358,6 +7344,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -8934,21 +8934,7 @@ daily
Rationale:
Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8969,7 +8955,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 61 groups and 184 rules
Group   @@ -124,14 +124,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -141,12 +134,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -761,14 +761,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -778,12 +771,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1343,23 +1343,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7632,21 +7632,7 @@
 authentication to privileged accounts. Users will first login, then escalate
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7654,7 +7640,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7670,6 +7656,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -9291,21 +9291,7 @@ daily
Rationale:
Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -9326,7 +9312,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 57 groups and 160 rules
Group   @@ -124,14 +124,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -141,12 +134,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -449,14 +449,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -466,12 +459,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1031,23 +1031,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7320,21 +7320,7 @@
 authentication to privileged accounts. Users will first login, then escalate
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7342,7 +7328,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7358,6 +7344,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 2 rules
[ref]   @@ -8519,21 +8519,7 @@ daily
Rationale:
Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8554,7 +8540,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 27 groups and 43 rules
Group   @@ -242,23 +242,23 @@ 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6555,14 +6555,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1, SV-230477r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6572,12 +6565,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6599,15 +6599,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2, SV-230298r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6618,9 +6610,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6741,14 +6741,7 @@
 
 $ sudo yum erase dhcp-server
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
-
-class remove_dhcp-server {
-  package { 'dhcp-server':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp-server
 #	   from the system, and may remove any packages
 #	   that depend on dhcp-server. Execute this
@@ -6760,8 +6753,15 @@
     yum remove -y "dhcp-server"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp-server
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
+
+class remove_dhcp-server {
+  package { 'dhcp-server':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp-server is removed
   package:
     name: dhcp-server
@@ -6808,14 +6808,7 @@
 $ sudo yum erase sendmail
Rationale:
The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049, SV-230489r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6833,8 +6826,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6883,14 +6883,7 @@
 
 $ sudo yum erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, 2.1.1


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -79,7 +79,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 99 groups and 293 rules
Group   @@ -123,14 +123,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -140,12 +133,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -441,27 +441,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -479,7 +459,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -524,6 +504,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -716,14 +716,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -733,12 +726,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -29409,21 +29409,7 @@
 add the line to file /etc/audit/audit.rules.
Rationale:
The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, 4.1.3.19, SV-230446r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -29757,7 +29743,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -30072,6 +30058,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -79,7 +79,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 88 groups and 226 rules
Group   @@ -123,14 +123,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -140,12 +133,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -441,27 +441,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -479,7 +459,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -524,6 +504,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -641,14 +641,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -658,12 +651,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8467,14 +8467,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1, SV-230477r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8484,12 +8477,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8511,15 +8511,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2, SV-230298r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -79,7 +79,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 84 groups and 223 rules
Group   @@ -123,14 +123,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -140,12 +133,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -441,27 +441,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -479,7 +459,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -524,6 +504,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -641,14 +641,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -658,12 +651,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8467,14 +8467,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1, SV-230477r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8484,12 +8477,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8511,15 +8511,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2, SV-230298r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
@@ -79,7 +79,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 95 groups and 290 rules
Group   @@ -123,14 +123,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -140,12 +133,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -441,27 +441,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -479,7 +459,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -524,6 +504,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -716,14 +716,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -733,12 +726,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -29409,21 +29409,7 @@
 add the line to file /etc/audit/audit.rules.
Rationale:
The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, 4.1.3.19, SV-230446r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -29757,7 +29743,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -30072,6 +30058,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cjis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
@@ -78,7 +78,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCriminal Justice Information Services (CJIS) Security Policy
Profile IDxccdf_org.ssgproject.content_profile_cjis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 48 groups and 105 rules
Group   @@ -427,14 +427,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -444,12 +437,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -745,27 +745,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -783,7 +763,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -828,6 +808,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4063,26 +4063,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -4119,7 +4100,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -4237,6 +4218,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 rule
[ref]   @@ -19676,21 +19676,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
@@ -90,7 +90,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleUnclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile IDxccdf_org.ssgproject.content_profile_cui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
    9. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Kerberos
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. SSH Server
    8. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 62 groups and 210 rules
Group   @@ -134,14 +134,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -151,12 +144,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -434,23 +434,23 @@
 $ sudo yum install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     yum install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -513,27 +513,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -551,7 +531,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -596,6 +576,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1031,14 +1031,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -1048,12 +1041,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1078,23 +1078,23 @@
 $ sudo yum install dnf-plugin-subscription-manager
Rationale:
This package provides plugins to interact with repositories and subscriptions from the Red Hat entitlement platform; contains subscription-manager and product-id plugins.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-plugin-subscription-manager_installed
Identifiers and References

References:  - 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-plugin-subscription-manager
-
-class install_dnf-plugin-subscription-manager {
-  package { 'dnf-plugin-subscription-manager':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-plugin-subscription-manager" ; then
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Obsolete Services
    4. Proxy Server
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 48 groups and 98 rules
Group   @@ -578,27 +578,7 @@ submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT:NO-SHA1'
 
 
@@ -616,7 +596,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT:NO-SHA1
   tags:
@@ -661,6 +641,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -942,23 +942,23 @@   [ref]
The rear package can be installed with the following command: 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable -image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rear" ; then
     yum install -y "rear"
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1563,26 +1563,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1619,7 +1600,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1737,6 +1718,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -8531,21 +8531,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -8885,7 +8871,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -83,7 +83,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 54 groups and 137 rules
Group   @@ -461,27 +461,7 @@ submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -499,7 +479,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -544,6 +524,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1405,26 +1405,7 @@ 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, SV-230532r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1444,10 +1425,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -1508,6 +1497,17 @@
   - medium_severity
   - no_reboot_needed
   - service_debug-shell_disabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: false
+        name: debug-shell.service

Rule   Disable Ctrl-Alt-Del Burst Action   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1525,21 +1525,7 @@ can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Identifiers and References

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, SV-230531r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,CtrlAltDelBurstAction%3Dnone
-        mode: 0644
-        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
 # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
@@ -1572,7 +1558,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -1608,6 +1594,20 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,CtrlAltDelBurstAction%3Dnone
+        mode: 0644
+        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
+        overwrite: true

Rule   Disable Ctrl-Alt-Del Reboot Activation   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1625,18 +1625,7 @@ can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

References:  /usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ism_o.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ism_o.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ism_o.html 2022-10-05 00:00:00.000000000 +0000 @@ -84,7 +84,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) ISM Official
Profile IDxccdf_org.ssgproject.content_profile_ism_o

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. Obsolete Services
    5. Proxy Server
    6. Network Routing
    7. SNMP Server
    8. SSH Server
    9. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 71 groups and 151 rules
Group   @@ -553,14 +553,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -570,12 +563,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -777,27 +777,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -815,7 +795,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -860,6 +840,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1017,14 +1017,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -1034,12 +1027,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1294,23 +1294,23 @@
                                   [ref]
The rear package can be installed with the following command: 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable -image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rear" ; then
     yum install -y "rear"
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -6130,26 +6130,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -81,7 +81,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProtection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
    9. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Kerberos
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. SSH Server
    8. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 62 groups and 210 rules
Group   @@ -125,14 +125,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -142,12 +135,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -425,23 +425,23 @@
 $ sudo yum install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     yum install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -504,27 +504,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -542,7 +522,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -587,6 +567,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1022,14 +1022,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -1039,12 +1032,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1069,23 +1069,23 @@
 $ sudo yum install dnf-plugin-subscription-manager
Rationale:
This package provides plugins to interact with repositories and subscriptions from the Red Hat entitlement platform; contains subscription-manager and product-id plugins.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-plugin-subscription-manager_installed
Identifiers and References

References:  - 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-plugin-subscription-manager
-
-class install_dnf-plugin-subscription-manager {
-  package { 'dnf-plugin-subscription-manager':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-plugin-subscription-manager" ; then
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 49 groups and 125 rules
Group   @@ -423,14 +423,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -440,12 +433,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -766,27 +766,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -804,7 +784,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -849,6 +829,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -6516,14 +6516,7 @@ providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, SV-230275r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, SV-230275r627750_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -6533,12 +6526,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -6559,14 +6559,7 @@
 
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -6576,12 +6569,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -6609,15 +6609,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-rht-ccp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-rht-ccp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-rht-ccp.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleRed Hat Corporate Profile for Certified Cloud Providers (RH CCP)
Profile IDxccdf_org.ssgproject.content_profile_rht-ccp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Base Services
    2. Obsolete Services
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 39 groups and 71 rules
Group   @@ -121,14 +121,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -138,12 +131,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -201,27 +201,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -239,7 +219,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -284,6 +264,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4576,26 +4576,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -4632,7 +4613,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -4750,6 +4731,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 2 rules
[ref]   @@ -5391,15 +5391,7 @@ 
$ sudo systemctl enable firewalld.service
Rationale:
Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Identifiers and References

References:  - 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, 3.4.1.4, SV-244544r743881_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
-
-class enable_firewalld {
-  service {'firewalld':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5410,9 +5402,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 29 groups and 57 rules
Group   @@ -479,27 +479,7 @@ submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -517,7 +497,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -562,6 +542,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1201,26 +1201,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1257,7 +1238,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1375,6 +1356,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 1 rule
[ref]   @@ -16237,21 +16237,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -16591,7 +16577,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -16909,6 +16895,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -16932,21 +16932,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -85,7 +85,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Kerberos
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. SSH Server
    11. System Security Services Daemon
    12. USBGuard daemon
    13. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 106 groups and 389 rules
Group   @@ -129,14 +129,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -146,12 +139,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1599,27 +1599,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1637,7 +1617,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1682,6 +1662,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure GnuTLS library to use DoD-approved TLS Encryption   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4750,23 +4750,23 @@ 
 $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

References:  - CCI-000366, SRG-OS-000480-GPOS-00227, SV-244527r743830_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227, SV-244527r743830_rule

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -4785,14 +4785,7 @@
 
 $ sudo yum erase abrt-addon-ccpp
Rationale:
abrt-addon-ccpp contains hooks for C/C++ crashed programs and abrt's C/C++ analyzer plugin.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
-
-class remove_abrt-addon-ccpp {
-  package { 'abrt-addon-ccpp':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-ccpp
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-ccpp. Execute this
@@ -4804,8 +4797,15 @@
     yum remove -y "abrt-addon-ccpp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-addon-ccpp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
+
+class remove_abrt-addon-ccpp {
+  package { 'abrt-addon-ccpp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-addon-ccpp is removed
   package:
     name: abrt-addon-ccpp
@@ -4824,14 +4824,7 @@
 
 $ sudo yum erase abrt-addon-kerneloops
Rationale:
abrt-addon-kerneloops contains plugins for collecting kernel crash information and reporter plugin which sends this information to a specified server, usually to kerneloops.org.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-kerneloops
-
-class remove_abrt-addon-kerneloops {
-  package { 'abrt-addon-kerneloops':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-kerneloops
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-kerneloops. Execute this
@@ -4843,8 +4836,15 @@
     yum remove -y "abrt-addon-kerneloops"
 
/usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-centos8-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
@@ -91,7 +91,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG with GUI for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:centos:centos:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Kerberos
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. SSH Server
    11. System Security Services Daemon
    12. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 104 groups and 386 rules
Group   @@ -135,14 +135,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -152,12 +145,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1605,27 +1605,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1643,7 +1623,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1688,6 +1668,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure GnuTLS library to use DoD-approved TLS Encryption   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4756,23 +4756,23 @@ 
 $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

References:  - CCI-000366, SRG-OS-000480-GPOS-00227, SV-244527r743830_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227, SV-244527r743830_rule

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -4791,14 +4791,7 @@
 
 $ sudo yum erase abrt-addon-ccpp
Rationale:
abrt-addon-ccpp contains hooks for C/C++ crashed programs and abrt's C/C++ analyzer plugin.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
-
-class remove_abrt-addon-ccpp {
-  package { 'abrt-addon-ccpp':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-ccpp
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-ccpp. Execute this
@@ -4810,8 +4803,15 @@
     yum remove -y "abrt-addon-ccpp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-addon-ccpp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
+
+class remove_abrt-addon-ccpp {
+  package { 'abrt-addon-ccpp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-addon-ccpp is removed
   package:
     name: abrt-addon-ccpp
@@ -4830,14 +4830,7 @@
 
 $ sudo yum erase abrt-addon-kerneloops
Rationale:
abrt-addon-kerneloops contains plugins for collecting kernel crash information and reporter plugin which sends this information to a specified server, usually to kerneloops.org.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-kerneloops
-
-class remove_abrt-addon-kerneloops {
-  package { 'abrt-addon-kerneloops':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-kerneloops
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-kerneloops. Execute this
@@ -4849,8 +4842,15 @@
     yum remove -y "abrt-addon-kerneloops"
 
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 61 groups and 162 rules
Group   @@ -124,14 +124,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -141,12 +134,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -409,14 +409,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -426,12 +419,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -741,23 +741,23 @@
 
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6891,21 +6891,7 @@
 authentication to privileged accounts. Users will first login, then escalate
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -6913,7 +6899,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -6929,6 +6915,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -8435,21 +8435,7 @@ daily
Rationale:
Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8470,7 +8456,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 61 groups and 175 rules
Group   @@ -124,14 +124,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -141,12 +134,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -677,14 +677,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -694,12 +687,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1009,23 +1009,23 @@
 
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7159,21 +7159,7 @@
 authentication to privileged accounts. Users will first login, then escalate
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7181,7 +7167,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7197,6 +7183,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -8748,21 +8748,7 @@ daily
Rationale:
Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8783,7 +8769,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 57 groups and 151 rules
Group   @@ -124,14 +124,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -141,12 +134,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -409,14 +409,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -426,12 +419,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -741,23 +741,23 @@
 
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6891,21 +6891,7 @@
 authentication to privileged accounts. Users will first login, then escalate
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -6913,7 +6899,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -6929,6 +6915,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 2 rules
[ref]   @@ -8028,21 +8028,7 @@ daily
Rationale:
Log files that are not properly rotated run the risk of growing so large that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8063,7 +8049,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 27 groups and 43 rules
Group   @@ -236,23 +236,23 @@ 
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6454,14 +6454,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo dnf install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6471,12 +6464,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6497,15 +6497,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6516,9 +6508,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6638,14 +6638,7 @@
 
 $ sudo dnf erase dhcp-server
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
-
-class remove_dhcp-server {
-  package { 'dhcp-server':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp-server
 #	   from the system, and may remove any packages
 #	   that depend on dhcp-server. Execute this
@@ -6657,8 +6650,15 @@
     dnf remove -y "dhcp-server"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp-server
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
+
+class remove_dhcp-server {
+  package { 'dhcp-server':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp-server is removed
   package:
     name: dhcp-server
@@ -6705,14 +6705,7 @@
 $ sudo dnf erase sendmail
Rationale:
The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6730,8 +6723,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6779,14 +6779,7 @@
 
 $ sudo dnf erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 99 groups and 285 rules
Group   @@ -120,14 +120,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -137,12 +130,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -437,27 +437,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -475,7 +455,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -518,6 +498,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -709,14 +709,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -726,12 +719,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -28993,21 +28993,7 @@
 add the line to file /etc/audit/audit.rules.
Rationale:
The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -29341,7 +29327,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -29652,6 +29638,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 88 groups and 218 rules
Group   @@ -120,14 +120,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -137,12 +130,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -437,27 +437,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -475,7 +455,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -518,6 +498,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -634,14 +634,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -651,12 +644,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -7997,14 +7997,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo dnf install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8014,12 +8007,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8040,15 +8040,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 84 groups and 215 rules
Group   @@ -120,14 +120,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -137,12 +130,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -437,27 +437,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -475,7 +455,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -518,6 +498,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -634,14 +634,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -651,12 +644,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -7997,14 +7997,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo dnf install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8014,12 +8007,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8040,15 +8040,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 95 groups and 282 rules
Group   @@ -120,14 +120,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -137,12 +130,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -437,27 +437,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -475,7 +455,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -518,6 +498,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -709,14 +709,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -726,12 +719,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -28993,21 +28993,7 @@
 add the line to file /etc/audit/audit.rules.
Rationale:
The removal of kernel modules can be used to alter the behavior of the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -29341,7 +29327,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -29652,6 +29638,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
@@ -90,7 +90,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile IDxccdf_org.ssgproject.content_profile_cui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. SSH Server
    5. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 46 groups and 144 rules
Group   @@ -280,23 +280,23 @@ $ sudo dnf install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -334,27 +334,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -372,7 +352,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -415,6 +395,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure OpenSSL library to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -610,14 +610,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -627,12 +620,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -661,23 +661,23 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
     dnf install -y "gnutls-utils"
 fi
-


+


 [[packages]]
 name = "gnutls-utils"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=gnutls-utils
+

Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -696,23 +696,23 @@
 $ sudo dnf install openscap-scanner
Rationale:
openscap-scanner contains the oscap command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
-
-class install_openscap-scanner {
-  package { 'openscap-scanner':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "openscap-scanner" ; then
     dnf install -y "openscap-scanner"
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Obsolete Services
    4. Proxy Server
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 48 groups and 98 rules
Group   @@ -448,27 +448,7 @@ submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT:NO-SHA1'
 
 
@@ -486,7 +466,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT:NO-SHA1
   tags:
@@ -529,6 +509,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -803,14 +803,7 @@   [ref]
The rear package can be installed with the following command: 
 $ sudo dnf install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable -image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if ! grep -q aarch64 /proc/sys/kernel/osrelease; then
 
 if ! rpm -q --quiet "rear" ; then
@@ -820,12 +813,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1400,26 +1400,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1456,7 +1437,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1571,6 +1552,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -8333,21 +8333,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -83,7 +83,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 52 groups and 135 rules
Group   @@ -331,27 +331,7 @@ submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -369,7 +349,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -412,6 +392,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1266,26 +1266,7 @@ 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1305,10 +1286,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -1366,6 +1355,17 @@
   - medium_severity
   - no_reboot_needed
   - service_debug-shell_disabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: false
+        name: debug-shell.service

Rule   Disable Ctrl-Alt-Del Burst Action   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1383,21 +1383,7 @@ can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Identifiers and References

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,CtrlAltDelBurstAction%3Dnone
-        mode: 0644
-        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
 # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
@@ -1430,6 +1416,20 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,CtrlAltDelBurstAction%3Dnone
+        mode: 0644
+        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
+        overwrite: true

Rule   Disable Ctrl-Alt-Del Reboot Activation   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1447,7 +1447,16 @@ can reboot the system. If accidentally pressed, as could happen in the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227



# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+systemctl disable --now ctrl-alt-del.target
+systemctl mask --now ctrl-alt-del.target
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ism_o.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ism_o.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ism_o.html	2022-10-05 00:00:00.000000000 +0000
@@ -84,7 +84,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) ISM Official
Profile IDxccdf_org.ssgproject.content_profile_ism_o

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. Obsolete Services
    5. Proxy Server
    6. Network Routing
    7. SNMP Server
    8. SSH Server
    9. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 71 groups and 148 rules
Group   @@ -423,14 +423,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -440,12 +433,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -557,27 +557,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -595,7 +575,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -638,6 +618,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -685,14 +685,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -702,12 +695,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -956,14 +956,7 @@
                                   [ref]
The rear package can be installed with the following command: 
 $ sudo dnf install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable -image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if ! grep -q aarch64 /proc/sys/kernel/osrelease; then
 
 if ! rpm -q --quiet "rear" ; then
@@ -973,12 +966,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -5723,26 +5723,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -80,7 +80,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProtection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. SSH Server
    5. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 46 groups and 144 rules
Group   @@ -270,23 +270,23 @@ $ sudo dnf install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -324,27 +324,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -362,7 +342,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -405,6 +385,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure OpenSSL library to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -600,14 +600,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -617,12 +610,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -651,23 +651,23 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
     dnf install -y "gnutls-utils"
 fi
-


+


 [[packages]]
 name = "gnutls-utils"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=gnutls-utils
+

Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -686,23 +686,23 @@
 $ sudo dnf install openscap-scanner
Rationale:
openscap-scanner contains the oscap command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
-
-class install_openscap-scanner {
-  package { 'openscap-scanner':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "openscap-scanner" ; then
     dnf install -y "openscap-scanner"
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 9
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 49 groups and 123 rules
Group   @@ -293,14 +293,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -310,12 +303,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -635,27 +635,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -673,7 +653,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -716,6 +696,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -6313,14 +6313,7 @@ providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -6330,12 +6323,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -6355,14 +6355,7 @@
 
 $ sudo dnf install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -6372,12 +6365,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -6405,15 +6405,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -86,7 +86,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] DISA STIG for Red Hat Enterprise Linux 9
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. Application Whitelisting Daemon
    4. FTP Server
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. Network Routing
    11. SSH Server
    12. System Security Services Daemon
    13. USBGuard daemon
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 115 groups and 494 rules
Group   @@ -130,14 +130,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -147,12 +140,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1509,23 +1509,23 @@
 $ sudo dnf install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -1588,27 +1588,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1626,7 +1606,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1669,6 +1649,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -3616,14 +3616,7 @@ 
$ sudo yum remove gdm
Rationale:
Unnecessary service packages must not be installed to decrease the attack surface of the system. A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if rpm --quiet -q gdm; then
 
 # CAUTION: This remediation script will remove gdm
@@ -3641,8 +3634,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=gdm
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
+
+class remove_gdm {
+  package { 'gdm':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -3708,14 +3708,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -3725,12 +3718,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-cs9-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
@@ -92,7 +92,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] DISA STIG with GUI for Red Hat Enterprise Linux 9
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9
  • cpe:/o:centos:centos:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. Application Whitelisting Daemon
    4. FTP Server
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. Network Routing
    11. SSH Server
    12. System Security Services Daemon
    13. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 113 groups and 490 rules
Group   @@ -136,14 +136,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -153,12 +146,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1515,23 +1515,23 @@
 $ sudo dnf install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -1594,27 +1594,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1632,7 +1612,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1675,6 +1655,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -3646,14 +3646,7 @@ limited root privileges to users and log root activity. The basic philosophy is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -3663,12 +3656,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -4324,23 +4324,23 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -72,7 +72,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleOSPP - Protection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:fedoraproject:fedora:38
  • cpe:/o:fedoraproject:fedora:37
  • cpe:/o:fedoraproject:fedora:36
  • cpe:/o:fedoraproject:fedora:35

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Mail Server Software
    4. Network Time Protocol
    5. Hardware RNG Entropy Gatherer Daemon
    6. SSH Server
    7. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Fedora   Group contains 62 groups and 206 rules
Group   @@ -483,27 +483,7 @@ submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -521,7 +501,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -564,6 +544,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -2142,23 +2142,23 @@ 
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6994,14 +6994,7 @@
 session lock.
 


 The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -7011,12 +7004,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -7046,26 +7046,7 @@
 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -7085,10 +7066,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -7146,6 +7135,17 @@
   - medium_severity
   - no_reboot_needed
/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Fedora
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:fedoraproject:fedora:38
  • cpe:/o:fedoraproject:fedora:37
  • cpe:/o:fedoraproject:fedora:36
  • cpe:/o:fedoraproject:fedora:35

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Fedora   Group contains 47 groups and 121 rules
Group   @@ -414,14 +414,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -431,12 +424,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -756,27 +756,7 @@
 submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -794,7 +774,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -837,6 +817,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -5957,14 +5957,7 @@ providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -5974,12 +5967,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -5999,14 +5999,7 @@
 
 $ sudo dnf install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -6016,12 +6009,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -6049,15 +6049,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-fedora-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Fedora
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:fedoraproject:fedora:38
  • cpe:/o:fedoraproject:fedora:37
  • cpe:/o:fedoraproject:fedora:36
  • cpe:/o:fedoraproject:fedora:35

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Network Configuration and Firewalls
    5. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server

Checklist

Group   Guide to the Secure Configuration of Fedora   Group contains 39 groups and 76 rules
Group   @@ -578,27 +578,7 @@ submits to this process.
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -616,7 +596,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -659,6 +639,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -2008,26 +2008,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -2064,7 +2045,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -2179,6 +2160,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true

Rule   Verify No netrc Files Exist   [ref]

The .netrc files contain login information @@ -2245,21 +2245,7 @@ authentication to privileged accounts. Users will first login, then escalate to privileged (root) access via su / sudo. This is required for FISMA Low and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -2267,7 +2253,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -2283,6 +2269,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true

Rule   Restrict Serial Port Root Logins   [ref]

To restrict root logins on serial ports, @@ -13127,21 +13127,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_enhanced

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 61 groups and 161 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -400,14 +400,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -417,12 +410,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8630,14 +8630,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8647,12 +8640,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8673,15 +8673,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -8692,9 +8684,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -17245,14 +17245,7 @@
 
 $ sudo yum erase dhcp
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -17264,8 +17257,15 @@
     yum remove -y "dhcp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -17401,14 +17401,7 @@
 $ sudo yum erase sendmail
Rationale:
The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDRAFT - ANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_high

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 61 groups and 175 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -717,14 +717,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -734,12 +727,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -9049,14 +9049,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -9066,12 +9059,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -9092,15 +9092,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -9111,9 +9103,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -17770,14 +17770,7 @@
 
 $ sudo yum erase setroubleshoot-plugins
Rationale:
The SETroubleshoot service is an unnecessary daemon to have running on a server.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_setroubleshoot-plugins_removed
Identifiers and References

References:  - BP28(R68)


Complexity:low
Disruption:low
Strategy:disable
include remove_setroubleshoot-plugins
-
-class remove_setroubleshoot-plugins {
-  package { 'setroubleshoot-plugins':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            BP28(R68)

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove setroubleshoot-plugins
@@ -17795,8 +17788,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=setroubleshoot-plugins
+

Complexity:low
Disruption:low
Strategy:disable
include remove_setroubleshoot-plugins
+
+class remove_setroubleshoot-plugins {
+  package { 'setroubleshoot-plugins':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure setroubleshoot-plugins is removed
   package:
     name: setroubleshoot-plugins
@@ -17818,14 +17818,7 @@
 
 $ sudo yum erase setroubleshoot-server
Rationale:
The SETroubleshoot service is an unnecessary daemon to have running on a server.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_setroubleshoot-server_removed
Identifiers and References

References:  - BP28(R68)


Complexity:low
Disruption:low
Strategy:disable
include remove_setroubleshoot-server
-
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_intermediary

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 57 groups and 151 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -400,14 +400,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -417,12 +410,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8218,14 +8218,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8235,12 +8228,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8261,15 +8261,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -8280,9 +8272,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -16656,14 +16656,7 @@
 
 $ sudo yum erase dhcp
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -16675,8 +16668,15 @@
     yum remove -y "dhcp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -16812,14 +16812,7 @@
 $ sudo yum erase sendmail
Rationale:
The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-anssi_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_minimal

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 27 groups and 38 rules
Group   @@ -6168,14 +6168,7 @@ Ensure rsyslog is Installed   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6185,12 +6178,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6211,15 +6211,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6230,9 +6222,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6352,14 +6352,7 @@
 
 $ sudo yum erase dhcp
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -6371,8 +6364,15 @@
     yum remove -y "dhcp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -6419,14 +6419,7 @@
 $ sudo yum erase sendmail
Rationale:
The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6444,8 +6437,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6493,14 +6493,7 @@
 
 $ sudo yum erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove xinetd
@@ -6518,8 +6511,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=xinetd
+

Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
+
+class remove_xinetd {
+  package { 'xinetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure xinetd is removed
   package:
     name: xinetd
@@ -6553,14 +6553,7 @@
 NIS maps. NIS generally has been replaced by such protocols as Lightweight
 Directory Access Protocol (LDAP). It is recommended that the service be
 removed.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_package_ypbind_removed
Identifiers and References

References:  - BP28(R1), 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)


Complexity:low
Disruption:low
Strategy:disable
include remove_ypbind
-
-class remove_ypbind {
-  package { 'ypbind':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ypbind
 #	   from the system, and may remove any packages
 #	   that depend on ypbind. Execute this
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cjis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
@@ -69,7 +69,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCriminal Justice Information Services (CJIS) Security Policy
Profile IDxccdf_org.ssgproject.content_profile_cjis

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 47 groups and 102 rules
Group   @@ -426,14 +426,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -443,12 +436,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -3480,26 +3480,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -3536,7 +3517,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -3654,6 +3635,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 rule
[ref]   @@ -24543,26 +24543,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -24573,10 +24554,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -24642,6 +24631,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true

Rule   Enable Auditing for Processes Which Start Prior to the Audit Daemon   [ref]

To ensure all processes can be audited, even those which start @@ -25056,15 +25056,7 @@ 
$ sudo systemctl enable firewalld.service
Rationale:
Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Identifiers and References

References:  - 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, OL07-00-040520, SV-221868r603260_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
-
-class enable_firewalld {
-  service {'firewalld':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -25075,9 +25067,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
@@ -81,7 +81,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleUnclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile IDxccdf_org.ssgproject.content_profile_cui

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Base Services
    2. NFS and RPC
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 51 groups and 104 rules
Group   @@ -4945,14 +4945,7 @@ session lock.

The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110, OL07-00-010090


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -4962,12 +4955,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -4998,15 +4998,7 @@
 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5026,9 +5018,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
@@ -5544,26 +5544,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -5600,7 +5581,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -5718,6 +5699,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -6332,26 +6332,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6362,10 +6343,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -6431,6 +6420,17 @@
   - medium_severity
   - no_reboot_needed
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] Australian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Obsolete Services
    3. Proxy Server
    4. Network Routing
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 46 groups and 93 rules
Group   @@ -787,23 +787,23 @@   [ref]
The rear package can be installed with the following command: 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable -image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rear" ; then
     yum install -y "rear"
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1252,26 +1252,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1308,7 +1289,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1426,6 +1407,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -14827,26 +14827,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -14857,10 +14838,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -14926,6 +14915,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true
Group   Configure Syslog   Group contains 2 rules
[ref]   @@ -14948,14 +14948,7 @@ Ensure rsyslog is Installed   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -14965,12 +14958,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 54 groups and 142 rules
Group   @@ -1144,15 +1144,7 @@ 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1172,9 +1164,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
@@ -1586,26 +1586,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1642,7 +1623,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1760,6 +1741,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 3 rules
[ref]   @@ -44290,26 +44290,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -44320,10 +44301,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -44389,6 +44378,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true

Rule   Enable Auditing for Processes Which Start Prior to the Audit Daemon   [ref]

To ensure all processes can be audited, even those which start @@ -45028,15 +45028,7 @@

Additionally, automatically mounting filesystems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227, OL07-00-020110, SV-221714r603260_rule


Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
-
-class disable_autofs {
-  service {'autofs':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -45056,9 +45048,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ncp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ncp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ncp.html	2022-10-05 00:00:00.000000000 +0000
@@ -91,7 +91,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleNIST National Checklist Program Security Guide
Profile IDxccdf_org.ssgproject.content_profile_ncp

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. LDAP
    4. NFS and RPC
    5. Network Time Protocol
    6. Obsolete Services
    7. Network Routing
    8. SSH Server
    9. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 104 groups and 382 rules
Group   @@ -448,14 +448,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -465,12 +458,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -12187,14 +12187,7 @@
 session lock.
 


 The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110, OL07-00-010090


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -12204,12 +12197,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -12248,14 +12248,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -12265,12 +12258,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -12290,14 +12290,7 @@
 
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -12307,12 +12300,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -12340,15 +12340,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -12359,9 +12351,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["pcscd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
+
+class enable_pcscd {
+  service {'pcscd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service pcscd
   block:
 
@@ -12687,15 +12687,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -72,7 +72,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] Protection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Base Services
    2. NFS and RPC
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 51 groups and 104 rules
Group   @@ -4936,14 +4936,7 @@ session lock.

The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110, OL07-00-010090


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -4953,12 +4946,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -4989,15 +4989,7 @@
 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5017,9 +5009,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
@@ -5535,26 +5535,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -5591,7 +5572,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -5709,6 +5690,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -6323,26 +6323,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6353,10 +6334,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -6422,6 +6411,17 @@
   - medium_severity
   - no_reboot_needed
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline Draft for Oracle Linux 7
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 48 groups and 99 rules
Group   @@ -422,14 +422,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -439,12 +432,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -6135,26 +6135,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -6191,7 +6172,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -6309,6 +6290,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   System Accounting with auditd   Group contains 9 groups and 41 rules
[ref]   @@ -27075,26 +27075,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -27105,10 +27086,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -27174,6 +27163,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true

Rule   Enable Auditing for Processes Which Start Prior to the Audit Daemon   [ref]

To ensure all processes can be audited, even those which start @@ -28087,23 +28087,23 @@ $ sudo yum install libreswan
Rationale:
Providing the ability for remote users or systems to initiate a secure VPN connection protects information when it is transmitted over a wide area network.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_libreswan_installed
Identifiers and References

References:  - 12, 15, 3, 5, 8, APO13.01, DSS01.04, DSS05.02, DSS05.03, DSS05.04, CCI-001130, CCI-001131, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, SR 1.13, SR 2.6, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.4, A.11.2.6, A.13.1.1, A.13.2.1, A.14.1.3, A.15.1.1, A.15.2.1, A.6.2.1, A.6.2.2, CM-6(a), PR.AC-3, PR.MA-2, PR.PT-4, Req-4.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_libreswan
-
-class install_libreswan {
-  package { 'libreswan':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "libreswan" ; then
     yum install -y "libreswan"
 fi
-


+


 [[packages]]
 name = "libreswan"
 version = "*"
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-sap.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-sap.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-sap.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleSecurity Profile of Oracle Linux 7 for SAP
Profile IDxccdf_org.ssgproject.content_profile_sap

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. File Permissions and Masks
  2. Services
    1. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 10 groups and 9 rules
Group   @@ -94,23 +94,23 @@ $ sudo yum install glibc
Rationale:
The glibc package contains standard C and math libraries used by multiple programs on Linux. The glibc shipped with first release of each major Linux version is often not sufficient for SAP. -An update is required after the first OS installation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_glibc_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_glibc
-
-class install_glibc {
-  package { 'glibc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+An update is required after the first OS installation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_glibc_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "glibc" ; then
     yum install -y "glibc"
 fi
-


+


 [[packages]]
 name = "glibc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=glibc
+

Complexity:low
Disruption:low
Strategy:enable
include install_glibc
+
+class install_glibc {
+  package { 'glibc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure glibc is installed
   package:
     name: glibc
@@ -134,23 +134,23 @@
 
 $ sudo yum install uuidd
Rationale:
The uuidd package contains a userspace daemon (uuidd) which is used to generate unique identifiers even at very high rates on -SMP systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_uuidd_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_uuidd
-
-class install_uuidd {
-  package { 'uuidd':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+SMP systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_uuidd_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "uuidd" ; then
     yum install -y "uuidd"
 fi
-


+


 [[packages]]
 name = "uuidd"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=uuidd
+

Complexity:low
Disruption:low
Strategy:enable
include install_uuidd
+
+class install_uuidd {
+  package { 'uuidd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure uuidd is installed
   package:
     name: uuidd
@@ -402,14 +402,7 @@
 NIS maps. NIS generally has been replaced by such protocols as Lightweight
 Directory Access Protocol (LDAP). It is recommended that the service be
 removed.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_package_ypbind_removed
Identifiers and References

References:  - BP28(R1), 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii)


Complexity:low
Disruption:low
Strategy:disable
include remove_ypbind
-
-class remove_ypbind {
-  package { 'ypbind':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ypbind
 #	   from the system, and may remove any packages
 #	   that depend on ypbind. Execute this
@@ -421,8 +414,15 @@
     yum remove -y "ypbind"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=ypbind
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ypbind
+
+class remove_ypbind {
+  package { 'ypbind':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure ypbind is removed
   package:
     name: ypbind
@@ -444,14 +444,7 @@
 
 Removing the ypserv package decreases the risk of the accidental
 (or intentional) activation of NIS or NIS+ services.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_ypserv_removed
Identifiers and References

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000381, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), IA-5(1)(c), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000095-GPOS-00049, OL07-00-020010, SV-221705r603260_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_ypserv
-
-class remove_ypserv {
-  package { 'ypserv':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ypserv
 #	   from the system, and may remove any packages
 #	   that depend on ypserv. Execute this
@@ -463,8 +456,15 @@
     yum remove -y "ypserv"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=ypserv
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ypserv
+
+class remove_ypserv {
+  package { 'ypserv':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure ypserv is removed
   package:
     name: ypserv
@@ -498,15 +498,7 @@
 means that data from the login session, including passwords and
 all other information transmitted during the session, can be
 stolen by eavesdroppers on the network.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_service_rlogin_disabled
Identifiers and References

References:  - 1, 11, 12, 14, 15, 16, 3, 5, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10, 3.1.13, 3.4.7, CCI-001436, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), IA-5(1)(c), PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:enable
include disable_rlogin
-
-class disable_rlogin {
-  service {'rlogin':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -526,9 +518,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["rlogin"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_rlogin
+
+class disable_rlogin {
+  service {'rlogin':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service rlogin
   block:
 
@@ -611,15 +611,7 @@
 means that data from the login session, including passwords and
 all other information transmitted during the session, can be
 stolen by eavesdroppers on the network.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_service_rsh_disabled
Identifiers and References

References:  - 1, 11, 12, 14, 15, 16, 3, 5, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10, 3.1.13, 3.4.7, CCI-000068, CCI-001436, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), IA-5(1)(c), PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:enable
include disable_rsh
-
-class disable_rsh {
-  service {'rsh':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -639,9 +631,17 @@
 else
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Oracle Linux 7
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 28 groups and 72 rules
Group   @@ -739,26 +739,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -795,7 +776,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -913,6 +894,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 2 rules
[ref]   @@ -28880,14 +28880,7 @@ Ensure rsyslog is Installed   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -28897,12 +28890,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -28923,15 +28923,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -28942,9 +28934,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -29132,15 +29132,7 @@
 


 Additionally, automatically mounting filesystems permits easy introduction of
 unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227, OL07-00-020110, SV-221714r603260_rule


Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
-
-class disable_autofs {
-  service {'autofs':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -29160,9 +29152,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["autofs"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
+
+class disable_autofs {
+  service {'autofs':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service autofs
   block:
 
@@ -29612,15 +29612,7 @@
 
$ sudo systemctl mask --now abrtd.service
Rationale:
Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_abrtd_disabled
Identifiers and References

References:  - 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:enable
include disable_abrtd
-
-class disable_abrtd {
-  service {'abrtd':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG for Oracle Linux 7
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. FTP Server
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. SNMP Server
    9. SSH Server
    10. System Security Services Daemon
    11. X Window System

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 102 groups and 270 rules
Group   @@ -546,14 +546,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -563,12 +556,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -11367,14 +11367,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_install_smartcard_packages
Identifiers and References

References:  - CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, OL07-00-041001, SV-221895r603260_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
-
-class install_pam_pkcs11 {
-  package { 'pam_pkcs11':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, OL07-00-041001, SV-221895r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ! grep -q s390x /proc/sys/kernel/osrelease; }; then
 
 if ! rpm -q --quiet "pam_pkcs11" ; then
@@ -11384,12 +11377,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_pkcs11"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pam_pkcs11
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
+
+class install_pam_pkcs11 {
+  package { 'pam_pkcs11':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_pkcs11 is installed
   package:
     name: pam_pkcs11
@@ -12065,26 +12065,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -12121,7 +12102,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -12239,6 +12220,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true

Rule   Ensure There Are No Accounts With Blank or Null Passwords   [ref]

Check the "/etc/shadow" file for blank passwords with the @@ -52052,26 +52052,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -52082,10 +52063,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -52151,6 +52140,17 @@
/usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol7-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
@@ -72,7 +72,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG with GUI for Oracle Linux 7
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:oracle:linux:7

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. FTP Server
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. SNMP Server
    9. SSH Server
    10. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 7   Group contains 100 groups and 269 rules
Group   @@ -552,14 +552,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL07-00-020029, SV-251701r833031_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -569,12 +562,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -11373,14 +11373,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_install_smartcard_packages
Identifiers and References

References:  - CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, OL07-00-041001, SV-221895r603260_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
-
-class install_pam_pkcs11 {
-  package { 'pam_pkcs11':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, OL07-00-041001, SV-221895r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ! grep -q s390x /proc/sys/kernel/osrelease; }; then
 
 if ! rpm -q --quiet "pam_pkcs11" ; then
@@ -11390,12 +11383,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_pkcs11"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pam_pkcs11
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
+
+class install_pam_pkcs11 {
+  package { 'pam_pkcs11':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_pkcs11 is installed
   package:
     name: pam_pkcs11
@@ -12071,26 +12071,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL07-00-010290, SV-221687r809141_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -12127,7 +12108,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -12245,6 +12226,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true

Rule   Ensure There Are No Accounts With Blank or Null Passwords   [ref]

Check the "/etc/shadow" file for blank passwords with the @@ -52058,26 +52058,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL07-00-030000, SV-221764r603260_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -52088,10 +52069,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -52157,6 +52146,17 @@
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 61 groups and 169 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -400,14 +400,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -417,12 +410,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -974,23 +974,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -8930,14 +8930,7 @@
 
 $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, OL08-00-030680, SV-248813r780005_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, OL08-00-030680, SV-248813r780005_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog-gnutls" ; then
@@ -8947,12 +8940,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog-gnutls
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -8970,14 +8970,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, OL08-00-030670, SV-248812r780002_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8987,12 +8980,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -9014,15 +9014,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide /usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_high.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_high.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 61 groups and 183 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -712,14 +712,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -729,12 +722,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1286,23 +1286,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -9287,14 +9287,7 @@
 
 $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, OL08-00-030680, SV-248813r780005_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, OL08-00-030680, SV-248813r780005_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog-gnutls" ; then
@@ -9304,12 +9297,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog-gnutls
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -9327,14 +9327,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, OL08-00-030670, SV-248812r780002_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -9344,12 +9337,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -9371,15 +9371,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide /usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_intermediary.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_intermediary.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 57 groups and 159 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -400,14 +400,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -417,12 +410,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -974,23 +974,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -8516,14 +8516,7 @@
 
 $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, OL08-00-030680, SV-248813r780005_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061, OL08-00-030680, SV-248813r780005_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog-gnutls" ; then
@@ -8533,12 +8526,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog-gnutls
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -8556,14 +8556,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, OL08-00-030670, SV-248812r780002_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8573,12 +8566,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8600,15 +8600,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide /usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_minimal.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-anssi_bp28_minimal.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 27 groups and 43 rules
Group   @@ -231,23 +231,23 @@ 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6442,14 +6442,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, OL08-00-030670, SV-248812r780002_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6459,12 +6452,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6486,15 +6486,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, OL08-00-010561, SV-248615r779411_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6505,9 +6497,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6628,14 +6628,7 @@
 
 $ sudo yum erase dhcp-server
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -6647,8 +6640,15 @@
     yum remove -y "dhcp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -6695,14 +6695,7 @@
 $ sudo yum erase sendmail
Rationale:
The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049, OL08-00-040002, SV-248825r780041_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6720,8 +6713,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6770,14 +6770,7 @@
 
 $ sudo yum erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cjis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
@@ -69,7 +69,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCriminal Justice Information Services (CJIS) Security Policy
Profile IDxccdf_org.ssgproject.content_profile_cjis

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 49 groups and 105 rules
Group   @@ -418,14 +418,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -435,12 +428,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -3558,26 +3558,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL08-00-020331, SV-248715r779711_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -3614,7 +3595,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -3732,6 +3713,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 rule
[ref]   @@ -28092,26 +28092,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL08-00-030181, SV-248520r818594_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL08-00-030181, SV-248520r818594_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -28122,10 +28103,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -28191,6 +28180,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true

Rule   Enable Auditing for Processes Which Start Prior to the Audit Daemon   [ref]

To ensure all processes can be audited, even those which start @@ -28678,15 +28678,7 @@ 
$ sudo systemctl enable firewalld.service
Rationale:
Access control methods provide the ability to enhance system security posture by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Identifiers and References

References:  - 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, OL08-00-040101, SV-248841r780089_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
-
-class enable_firewalld {
-  service {'firewalld':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -28697,9 +28689,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
@@ -81,7 +81,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleUnclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile IDxccdf_org.ssgproject.content_profile_cui

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Kerberos
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. SSH Server
    8. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 63 groups and 205 rules
Group   @@ -125,14 +125,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -142,12 +135,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -425,23 +425,23 @@
 $ sudo yum install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     yum install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -982,14 +982,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -999,12 +992,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1033,23 +1033,23 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
     yum install -y "gnutls-utils"
 fi
-


+


 [[packages]]
 name = "gnutls-utils"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=gnutls-utils
+

Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -1068,23 +1068,23 @@
 $ sudo yum install openscap-scanner
Rationale:
openscap-scanner contains the oscap command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
-
-class install_openscap-scanner {
-  package { 'openscap-scanner':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "openscap-scanner" ; then
     yum install -y "openscap-scanner"
 fi
-


+


 [[packages]]
 name = "openscap-scanner"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=openscap-scanner
+

Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
+
+class install_openscap-scanner {
+  package { 'openscap-scanner':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure openscap-scanner is installed
   package:
     name: openscap-scanner
@@ -1109,23 +1109,23 @@
 package, or the SCAP Workbench GUI tool from the scap-workbench package, to verify
 that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
 page for futher information.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_scap-security-guide
-
-class install_scap-security-guide {
-  package { 'scap-security-guide':
-    ensure => 'installed',
-  }
-}
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] Australian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Obsolete Services
    4. Proxy Server
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 48 groups and 95 rules
Group   @@ -911,23 +911,23 @@   [ref]
The rear package can be installed with the following command: 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable -image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rear" ; then
     yum install -y "rear"
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1429,26 +1429,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL08-00-020331, SV-248715r779711_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1485,7 +1466,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1603,6 +1584,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -14567,26 +14567,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL08-00-030181, SV-248520r818594_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL08-00-030181, SV-248520r818594_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -14597,10 +14578,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -14666,6 +14655,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true
Group   Configure Syslog   Group contains 2 rules
[ref]   @@ -14688,14 +14688,7 @@ Ensure rsyslog is Installed   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, OL08-00-030670, SV-248812r780002_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -14705,12 +14698,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 54 groups and 140 rules
Group   @@ -1273,15 +1273,7 @@ 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, OL08-00-040180, SV-248872r780182_rule


Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1301,9 +1293,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
@@ -1719,26 +1719,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL08-00-020331, SV-248715r779711_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1775,7 +1756,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1893,6 +1874,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 3 rules
[ref]   @@ -47894,26 +47894,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL08-00-030181, SV-248520r818594_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, OL08-00-030181, SV-248520r818594_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -47924,10 +47905,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -47993,6 +47982,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true

Rule   Enable Auditing for Processes Which Start Prior to the Audit Daemon   [ref]

To ensure all processes can be audited, even those which start @@ -48769,15 +48769,7 @@

Additionally, automatically mounting filesystems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227, OL08-00-040070, SV-248836r780074_rule


Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
-
-class disable_autofs {
-  service {'autofs':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -48797,9 +48789,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -72,7 +72,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] Protection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Kerberos
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. SSH Server
    8. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 63 groups and 205 rules
Group   @@ -116,14 +116,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -416,23 +416,23 @@
 $ sudo yum install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     yum install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -973,14 +973,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -990,12 +983,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1024,23 +1024,23 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
     yum install -y "gnutls-utils"
 fi
-


+


 [[packages]]
 name = "gnutls-utils"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=gnutls-utils
+

Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -1059,23 +1059,23 @@
 $ sudo yum install openscap-scanner
Rationale:
openscap-scanner contains the oscap command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
-
-class install_openscap-scanner {
-  package { 'openscap-scanner':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "openscap-scanner" ; then
     yum install -y "openscap-scanner"
 fi
-


+


 [[packages]]
 name = "openscap-scanner"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=openscap-scanner
+

Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
+
+class install_openscap-scanner {
+  package { 'openscap-scanner':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure openscap-scanner is installed
   package:
     name: openscap-scanner
@@ -1100,23 +1100,23 @@
 package, or the SCAP Workbench GUI tool from the scap-workbench package, to verify
 that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
 page for futher information.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_scap-security-guide
-
-class install_scap-security-guide {
-  package { 'scap-security-guide':
-    ensure => 'installed',
-  }
-}
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline Draft for Oracle Linux 8
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 50 groups and 125 rules
Group   @@ -414,14 +414,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -431,12 +424,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -6010,14 +6010,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, OL08-00-010410, SV-248588r779330_rule


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, OL08-00-010410, SV-248588r779330_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -6027,12 +6020,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -6053,14 +6053,7 @@
 
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -6070,12 +6063,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -6103,15 +6103,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6122,9 +6114,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["pcscd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
+
+class enable_pcscd {
+  service {'pcscd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service pcscd
   block:
 
@@ -6631,26 +6631,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL08-00-020331, SV-248715r779711_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -6687,7 +6668,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -6805,6 +6786,25 @@
   - medium_disruption
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Oracle Linux 8
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 29 groups and 78 rules
Group   @@ -1070,26 +1070,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, OL08-00-020331, SV-248715r779711_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1126,7 +1107,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1244,6 +1225,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 2 rules
[ref]   @@ -32690,14 +32690,7 @@ Ensure rsyslog is Installed   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, OL08-00-030670, SV-248812r780002_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -32707,12 +32700,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -32734,15 +32734,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, OL08-00-010561, SV-248615r779411_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -32753,9 +32745,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -32946,15 +32946,7 @@
 


 Additionally, automatically mounting filesystems permits easy introduction of
 unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227, OL08-00-040070, SV-248836r780074_rule


Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
-
-class disable_autofs {
-  service {'autofs':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -32974,9 +32966,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["autofs"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
+
+class disable_autofs {
+  service {'autofs':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service autofs
   block:
 
@@ -33426,15 +33426,7 @@
 
$ sudo systemctl mask --now abrtd.service
Rationale:
Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_abrtd_disabled
Identifiers and References

References:  - 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:enable
include disable_abrtd
-
-class disable_abrtd {
-  service {'abrtd':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG for Oracle Linux 8
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Kerberos
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. SSH Server
    11. System Security Services Daemon
    12. USBGuard daemon
    13. X Window System

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 106 groups and 402 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -127,12 +120,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -4686,23 +4686,23 @@
 
 $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

References:  - CCI-000366, SRG-OS-000480-GPOS-00227, OL08-00-010472, SV-248600r779366_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227, OL08-00-010472, SV-248600r779366_rule

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -4720,14 +4720,7 @@
                                   [ref]
The abrt-libs package can be removed with the following command: 
 $ sudo yum erase abrt-libs
Rationale:
abrt-libs provides libraries for the ABRT package.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-libs_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-libs
-
-class remove_abrt-libs {
-  package { 'abrt-libs':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-libs
 #	   from the system, and may remove any packages
 #	   that depend on abrt-libs. Execute this
@@ -4739,8 +4732,15 @@
     yum remove -y "abrt-libs"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-libs
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-libs
+
+class remove_abrt-libs {
+  package { 'abrt-libs':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-libs is removed
   package:
     name: abrt-libs
@@ -4758,14 +4758,7 @@
                                   [ref]
The abrt-server-info-page package can be removed with the following command: 
 $ sudo yum erase abrt-server-info-page
Rationale:
abrt-server-info-page provides a web page with summary of ABRT services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-server-info-page_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-server-info-page
-
-class remove_abrt-server-info-page {
-  package { 'abrt-server-info-page':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-server-info-page
 #	   from the system, and may remove any packages
 #	   that depend on abrt-server-info-page. Execute this
@@ -4777,8 +4770,15 @@
     yum remove -y "abrt-server-info-page"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-server-info-page
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-server-info-page
+
+class remove_abrt-server-info-page {
+  package { 'abrt-server-info-page':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-server-info-page is removed
   package:
     name: abrt-server-info-page
@@ -4796,14 +4796,7 @@
                                   [ref]
The gssproxy package can be removed with the following command: 
 $ sudo yum erase gssproxy
Rationale:
gssproxy is a proxy for GSS API credential handling.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gssproxy_removed
Identifiers and References

References:  - CCI-000381, CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227, OL08-00-040370, SV-248904r780278_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
-
-class remove_gssproxy {
-  package { 'gssproxy':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove gssproxy
 #	   from the system, and may remove any packages
 #	   that depend on gssproxy. Execute this
@@ -4815,6 +4808,13 @@
     yum remove -y "gssproxy"
 
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
+
+class remove_gssproxy {
+  package { 'gssproxy':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure gssproxy is removed
   package:
     name: gssproxy
@@ -4833,14 +4833,7 @@
 
 $ sudo yum erase iprutils
Rationale:
iprutils provides a suite of utlilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_iprutils_removed
Identifiers and References

References:  - CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227, OL08-00-040380, SV-248905r780281_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_iprutils
-
-class remove_iprutils {
-  package { 'iprutils':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove iprutils
 #	   from the system, and may remove any packages
 #	   that depend on iprutils. Execute this
@@ -4852,8 +4845,15 @@
     yum remove -y "iprutils"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

/usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol8-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
@@ -72,7 +72,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG with GUI for Oracle Linux 8
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:oracle:linux:8

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Kerberos
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. SSH Server
    11. System Security Services Daemon
    12. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 8   Group contains 104 groups and 400 rules
Group   @@ -116,14 +116,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, OL08-00-010359, SV-252654r818758_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -4692,23 +4692,23 @@
 
 $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

References:  - CCI-000366, SRG-OS-000480-GPOS-00227, OL08-00-010472, SV-248600r779366_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227, OL08-00-010472, SV-248600r779366_rule

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -4726,14 +4726,7 @@
                                   [ref]
The abrt-libs package can be removed with the following command: 
 $ sudo yum erase abrt-libs
Rationale:
abrt-libs provides libraries for the ABRT package.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-libs_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-libs
-
-class remove_abrt-libs {
-  package { 'abrt-libs':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-libs
 #	   from the system, and may remove any packages
 #	   that depend on abrt-libs. Execute this
@@ -4745,8 +4738,15 @@
     yum remove -y "abrt-libs"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-libs
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-libs
+
+class remove_abrt-libs {
+  package { 'abrt-libs':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-libs is removed
   package:
     name: abrt-libs
@@ -4764,14 +4764,7 @@
                                   [ref]
The abrt-server-info-page package can be removed with the following command: 
 $ sudo yum erase abrt-server-info-page
Rationale:
abrt-server-info-page provides a web page with summary of ABRT services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-server-info-page_removed
Identifiers and References

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-server-info-page
-
-class remove_abrt-server-info-page {
-  package { 'abrt-server-info-page':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, OL08-00-040001, SV-248824r780038_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-server-info-page
 #	   from the system, and may remove any packages
 #	   that depend on abrt-server-info-page. Execute this
@@ -4783,8 +4776,15 @@
     yum remove -y "abrt-server-info-page"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-server-info-page
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-server-info-page
+
+class remove_abrt-server-info-page {
+  package { 'abrt-server-info-page':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-server-info-page is removed
   package:
     name: abrt-server-info-page
@@ -4802,14 +4802,7 @@
                                   [ref]
The gssproxy package can be removed with the following command: 
 $ sudo yum erase gssproxy
Rationale:
gssproxy is a proxy for GSS API credential handling.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gssproxy_removed
Identifiers and References

References:  - CCI-000381, CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227, OL08-00-040370, SV-248904r780278_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
-
-class remove_gssproxy {
-  package { 'gssproxy':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove gssproxy
 #	   from the system, and may remove any packages
 #	   that depend on gssproxy. Execute this
@@ -4821,6 +4814,13 @@
     yum remove -y "gssproxy"
 
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
+
+class remove_gssproxy {
+  package { 'gssproxy':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure gssproxy is removed
   package:
     name: gssproxy
@@ -4839,14 +4839,7 @@
 
 $ sudo yum erase iprutils
Rationale:
iprutils provides a suite of utlilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_iprutils_removed
Identifiers and References

References:  - CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227, OL08-00-040380, SV-248905r780281_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_iprutils
-
-class remove_iprutils {
-  package { 'iprutils':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove iprutils
 #	   from the system, and may remove any packages
 #	   that depend on iprutils. Execute this
@@ -4858,8 +4851,15 @@
     yum remove -y "iprutils"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 60 groups and 159 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -372,14 +372,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -389,12 +382,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -704,23 +704,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -8511,14 +8511,7 @@
 
 $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog-gnutls" ; then
@@ -8528,12 +8521,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog-gnutls
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -8550,14 +8550,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8567,12 +8560,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8593,15 +8593,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide /usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_high.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_high.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 60 groups and 171 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -640,14 +640,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -657,12 +650,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -972,23 +972,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -8824,14 +8824,7 @@
 
 $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog-gnutls" ; then
@@ -8841,12 +8834,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog-gnutls
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -8863,14 +8863,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8880,12 +8873,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8906,15 +8906,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide /usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_intermediary.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_intermediary.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 56 groups and 148 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -372,14 +372,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -389,12 +382,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -704,23 +704,23 @@
 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -8105,14 +8105,7 @@
 
 $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
-  package { 'rsyslog-gnutls':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog-gnutls" ; then
@@ -8122,12 +8115,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog-gnutls"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog-gnutls
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
+
+class install_rsyslog-gnutls {
+  package { 'rsyslog-gnutls':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog-gnutls is installed
   package:
     name: rsyslog-gnutls
@@ -8144,14 +8144,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8161,12 +8154,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8187,15 +8187,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide /usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_minimal.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-anssi_bp28_minimal.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 26 groups and 41 rules
Group   @@ -227,23 +227,23 @@ 
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6344,14 +6344,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6361,12 +6354,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6387,15 +6387,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6406,9 +6398,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6528,14 +6528,7 @@
 
 $ sudo yum erase dhcp-server
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -6547,8 +6540,15 @@
     yum remove -y "dhcp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -6595,14 +6595,7 @@
 $ sudo yum erase sendmail
Rationale:
The sendmail software was not developed with security in mind and its design prevents it from being effectively contained by SELinux. Postfix should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6620,8 +6613,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6669,14 +6669,7 @@
 
 $ sudo yum erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Obsolete Services
    4. Proxy Server
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 45 groups and 96 rules
Group   @@ -904,14 +904,7 @@   [ref]
The rear package can be installed with the following command: 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable -image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if ! grep -q aarch64 /proc/sys/kernel/osrelease; then
 
 if ! rpm -q --quiet "rear" ; then
@@ -921,12 +914,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1405,26 +1405,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1461,7 +1442,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1576,6 +1557,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -15022,26 +15022,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -15052,10 +15033,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -15119,6 +15108,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true
Group   Configure Syslog   Group contains 2 rules
[ref]   @@ -15141,14 +15141,7 @@ Ensure rsyslog is Installed   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -15158,12 +15151,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 52 groups and 135 rules
Group   @@ -1264,15 +1264,7 @@ 
$ sudo systemctl mask --now debug-shell.service
Rationale:
This prevents attackers with physical access from trivially bypassing security on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1292,9 +1284,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
@@ -1652,26 +1652,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1708,7 +1689,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1823,6 +1804,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 3 rules
[ref]   @@ -44224,26 +44224,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
-        enabled: true
-

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q audit; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -44254,10 +44235,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
-

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -44321,6 +44310,17 @@
   - medium_severity
   - no_reboot_needed
   - service_auditd_enabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: auditd.service
+        enabled: true

Rule   Enable Auditing for Processes Which Start Prior to the Audit Daemon   [ref]

To ensure all processes can be audited, even those which start @@ -44811,15 +44811,7 @@

Additionally, automatically mounting filesystems permits easy introduction of unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
-
-class disable_autofs {
-  service {'autofs':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -44839,9 +44831,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] Protection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Kerberos
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. SSH Server
    8. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 61 groups and 185 rules
Group   @@ -115,14 +115,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -322,23 +322,23 @@
 $ sudo yum install crypto-policies
Rationale:
Centralized cryptographic policies simplify applying secure ciphers across an operating system and the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     yum install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -762,14 +762,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -779,12 +772,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -813,23 +813,23 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
     yum install -y "gnutls-utils"
 fi
-


+


 [[packages]]
 name = "gnutls-utils"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=gnutls-utils
+

Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -848,23 +848,23 @@
 $ sudo yum install openscap-scanner
Rationale:
openscap-scanner contains the oscap command line tool. This tool is a configuration and vulnerability scanner, capable of performing compliance checking using SCAP content.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
-
-class install_openscap-scanner {
-  package { 'openscap-scanner':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "openscap-scanner" ; then
     yum install -y "openscap-scanner"
 fi
-


+


 [[packages]]
 name = "openscap-scanner"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=openscap-scanner
+

Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
+
+class install_openscap-scanner {
+  package { 'openscap-scanner':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure openscap-scanner is installed
   package:
     name: openscap-scanner
@@ -889,23 +889,23 @@
 package, or the SCAP Workbench GUI tool from the scap-workbench package, to verify
 that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
 page for futher information.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed
Identifiers and References

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_scap-security-guide
-
-class install_scap-security-guide {
-  package { 'scap-security-guide':
-    ensure => 'installed',
-  }
-}
/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Oracle Linux 9
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 29 groups and 78 rules
Group   @@ -1059,26 +1059,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1115,7 +1096,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1230,6 +1211,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 2 rules
[ref]   @@ -29118,14 +29118,7 @@ Ensure rsyslog is Installed   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -29135,12 +29128,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -29161,15 +29161,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -29180,9 +29172,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -29370,15 +29370,7 @@
 


 Additionally, automatically mounting filesystems permits easy introduction of
 unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
-
-class disable_autofs {
-  service {'autofs':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -29398,9 +29390,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["autofs"]
+

Complexity:low
Disruption:low
Strategy:enable
include disable_autofs
+
+class disable_autofs {
+  service {'autofs':
+    enable => false,
+    ensure => 'stopped',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service autofs
   block:
 
@@ -29837,15 +29837,7 @@
 
$ sudo systemctl mask --now abrtd.service
Rationale:
Mishandling crash data could expose sensitive information about vulnerabilities in software executing on the system, as well as sensitive information from within a process's address space or registers.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_abrtd_disabled
Identifiers and References

References:  - 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:enable
include disable_abrtd
-
-class disable_abrtd {
-  service {'abrtd':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] DISA STIG for Oracle Linux 9
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. Hardware RNG Entropy Gatherer Daemon
    9. SSH Server
    10. System Security Services Daemon
    11. USBGuard daemon
    12. X Window System

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 105 groups and 358 rules
Group   @@ -111,14 +111,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -128,12 +121,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -3499,23 +3499,23 @@
 
 $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

References:  - CCI-000366, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -3532,14 +3532,7 @@
                                   [ref]
The gssproxy package can be removed with the following command: 
 $ sudo yum erase gssproxy
Rationale:
gssproxy is a proxy for GSS API credential handling.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gssproxy_removed
Identifiers and References

References:  - CCI-000381, CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
-
-class remove_gssproxy {
-  package { 'gssproxy':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove gssproxy
 #	   from the system, and may remove any packages
 #	   that depend on gssproxy. Execute this
@@ -3551,6 +3544,13 @@
     yum remove -y "gssproxy"
 
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
+
+class remove_gssproxy {
+  package { 'gssproxy':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure gssproxy is removed
   package:
     name: gssproxy
@@ -3568,14 +3568,7 @@
 
 $ sudo yum erase iprutils
Rationale:
iprutils provides a suite of utlilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_iprutils_removed
Identifiers and References

References:  - CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_iprutils
-
-class remove_iprutils {
-  package { 'iprutils':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove iprutils
 #	   from the system, and may remove any packages
 #	   that depend on iprutils. Execute this
@@ -3587,8 +3580,15 @@
     yum remove -y "iprutils"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=iprutils
+

Complexity:low
Disruption:low
Strategy:disable
include remove_iprutils
+
+class remove_iprutils {
+  package { 'iprutils':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure iprutils is removed
   package:
     name: iprutils
@@ -3608,14 +3608,7 @@
 It does so by monitoring the usage of several system components periodically. Based
 on that information, components will then be put into lower or higher power savings
 modes to adapt to the current usage.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_tuned_removed
Identifiers and References

References:  - CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_tuned
-
-class remove_tuned {
-  package { 'tuned':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove tuned
 #	   from the system, and may remove any packages
 #	   that depend on tuned. Execute this
@@ -3627,8 +3620,15 @@
     yum remove -y "tuned"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=tuned
+

Complexity:low
Disruption:low
Strategy:disable
include remove_tuned
+
+class remove_tuned {
+  package { 'tuned':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure tuned is removed
   package:
     name: tuned
@@ -11894,14 +11894,7 @@
 session lock.
 


 The tmux package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_tmux_installed
Identifiers and References

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000058, CCI-000056, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_SMF_EXT.1, FMT_MOF_EXT.1, FTA_SSL.1, SRG-OS-000030-GPOS-00011, SRG-OS-000028-GPOS-00009, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_tmux
-
-class install_tmux {
-  package { 'tmux':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "tmux" ; then
@@ -11911,12 +11904,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ol9-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
@@ -73,7 +73,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] DISA STIG with GUI for Oracle Linux 9
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:oracle:linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. Hardware RNG Entropy Gatherer Daemon
    9. SSH Server
    10. System Security Services Daemon
    11. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Oracle Linux 9   Group contains 103 groups and 357 rules
Group   @@ -117,14 +117,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -134,12 +127,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -3505,23 +3505,23 @@
 
 $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

References:  - CCI-000366, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -3538,14 +3538,7 @@
                                   [ref]
The gssproxy package can be removed with the following command: 
 $ sudo yum erase gssproxy
Rationale:
gssproxy is a proxy for GSS API credential handling.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gssproxy_removed
Identifiers and References

References:  - CCI-000381, CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
-
-class remove_gssproxy {
-  package { 'gssproxy':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove gssproxy
 #	   from the system, and may remove any packages
 #	   that depend on gssproxy. Execute this
@@ -3557,6 +3550,13 @@
     yum remove -y "gssproxy"
 
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gssproxy
+
+class remove_gssproxy {
+  package { 'gssproxy':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure gssproxy is removed
   package:
     name: gssproxy
@@ -3574,14 +3574,7 @@
 
 $ sudo yum erase iprutils
Rationale:
iprutils provides a suite of utlilities to manage and configure SCSI devices supported by the ipr SCSI storage device driver.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_iprutils_removed
Identifiers and References

References:  - CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_iprutils
-
-class remove_iprutils {
-  package { 'iprutils':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove iprutils
 #	   from the system, and may remove any packages
 #	   that depend on iprutils. Execute this
@@ -3593,8 +3586,15 @@
     yum remove -y "iprutils"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=iprutils
+

Complexity:low
Disruption:low
Strategy:disable
include remove_iprutils
+
+class remove_iprutils {
+  package { 'iprutils':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure iprutils is removed
   package:
     name: iprutils
@@ -3614,14 +3614,7 @@
 It does so by monitoring the usage of several system components periodically. Based
 on that information, components will then be put into lower or higher power savings
 modes to adapt to the current usage.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_tuned_removed
Identifiers and References

References:  - CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_tuned
-
-class remove_tuned {
-  package { 'tuned':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000366, SRG-OS-000095-GPOS-00049, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove tuned
 #	   from the system, and may remove any packages
 #	   that depend on tuned. Execute this
@@ -3633,8 +3626,15 @@
     yum remove -y "tuned"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=tuned
+

Complexity:low
Disruption:low
Strategy:disable
include remove_tuned
+
+class remove_tuned {
+  package { 'tuned':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure tuned is removed
   package:
     name: tuned
@@ -11900,14 +11900,7 @@
 session lock.
 


 The tmux package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_tmux_installed
Identifiers and References

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000058, CCI-000056, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_SMF_EXT.1, FMT_MOF_EXT.1, FTA_SSL.1, SRG-OS-000030-GPOS-00011, SRG-OS-000028-GPOS-00009, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_tmux
-
-class install_tmux {
-  package { 'tmux':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "tmux" ; then
@@ -11917,12 +11910,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDRAFT - ANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Mail Server Software
    2. Network Time Protocol
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 43 groups and 90 rules
Group   /usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_high.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_high.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleDRAFT - ANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Mail Server Software
    2. Network Time Protocol
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 43 groups and 94 rules
Group   /usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_intermediary.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_intermediary.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleDRAFT - ANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Mail Server Software
    2. Network Time Protocol
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 40 groups and 82 rules
Group   /usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_minimal.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-anssi_bp28_minimal.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleDRAFT - ANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
  2. Services
    1. Mail Server Software

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 10 groups and 7 rules
Group   /usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-e8.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-e8.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. File Permissions and Masks
    5. SELinux
  2. Services
    1. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 23 groups and 51 rules
Group   /usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-high.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-high.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-high.html 2022-10-05 00:00:00.000000000 +0000 @@ -87,7 +87,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleNIST 800-53 High-Impact Baseline for Red Hat Enterprise Linux CoreOS
Profile IDxccdf_org.ssgproject.content_profile_high

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 52 groups and 242 rules
Group   @@ -572,8 +572,7 @@ on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-82496-1

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -581,9 +580,14 @@
       version: 3.1.0
     systemd:
       units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+      - name: debug-shell.service
+        enabled: false
+        mask: true
+      - name: debug-shell.socket
+        enabled: false
+        mask: true
+

---
+apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -591,12 +595,8 @@
       version: 3.1.0
     systemd:
       units:
-      - name: debug-shell.service
-        enabled: false
-        mask: true
-      - name: debug-shell.socket
-        enabled: false
-        mask: true
+      - enabled: false
+        name: debug-shell.service

Rule   Verify that Interactive Boot is Disabled   [ref]

Red Hat Enterprise Linux CoreOS 4 systems support an "interactive boot" option that can @@ -6664,7 +6664,7 @@ connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_bluetooth_disabled
Identifiers and References

References:  - 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 3.1.16, CCI-000085, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6678,7 +6678,7 @@
       - name: bluetooth.socket
         enabled: false
         mask: true
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6967,8 +6967,7 @@
 Additionally, automatically mounting filesystems permits easy introduction of
 unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

Identifiers:  CCE-82663-6

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6976,9 +6975,14 @@
       version: 3.1.0
     systemd:
       units:
-      - enabled: false
-        name: autofs.service
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+      - name: autofs.service
+        enabled: false
+        mask: true
+      - name: autofs.socket
+        enabled: false
+        mask: true
+

---
+apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6986,12 +6990,8 @@
       version: 3.1.0
     systemd:
       units:
-      - name: autofs.service
-        enabled: false
-        mask: true
-      - name: autofs.socket
-        enabled: false
-        mask: true
+      - enabled: false
+        name: autofs.service

Rule   Disable Booting from USB Devices in Boot Firmware   [ref]

Configure the system boot firmware (historically called BIOS on PC @@ -7268,7 +7268,7 @@ terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled
Identifiers and References

Identifiers:  CCE-82530-7

References:  - CCI-000366, SC-7(10), FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+            CCI-000366, SC-7(10), FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -7282,7 +7282,7 @@
       - name: systemd-coredump.socket
         enabled: false
         mask: true
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -8283,7 +8283,7 @@
 
 This is unusual, as SSH is a common method for encrypted and authenticated
 remote access.
Rationale:
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_service_sshd_disabled
Identifiers and References

References:  - CM-3(6), IA-2(4)


Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+            CM-3(6), IA-2(4)

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -8297,7 +8297,7 @@
       - name: sshd.socket
         enabled: false
         mask: true
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-moderate.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-moderate.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-moderate.html	2022-10-05 00:00:00.000000000 +0000
@@ -87,7 +87,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleNIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS
Profile IDxccdf_org.ssgproject.content_profile_moderate

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 52 groups and 241 rules
Group   @@ -572,8 +572,7 @@ on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-82496-1

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -581,9 +580,14 @@
       version: 3.1.0
     systemd:
       units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+      - name: debug-shell.service
+        enabled: false
+        mask: true
+      - name: debug-shell.socket
+        enabled: false
+        mask: true
+

---
+apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -591,12 +595,8 @@
       version: 3.1.0
     systemd:
       units:
-      - name: debug-shell.service
-        enabled: false
-        mask: true
-      - name: debug-shell.socket
-        enabled: false
-        mask: true
+      - enabled: false
+        name: debug-shell.service

Rule   Verify that Interactive Boot is Disabled   [ref]

Red Hat Enterprise Linux CoreOS 4 systems support an "interactive boot" option that can @@ -6664,7 +6664,7 @@ connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_bluetooth_disabled
Identifiers and References

References:  - 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 3.1.16, CCI-000085, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6678,7 +6678,7 @@
       - name: bluetooth.socket
         enabled: false
         mask: true
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6967,8 +6967,7 @@
 Additionally, automatically mounting filesystems permits easy introduction of
 unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

Identifiers:  CCE-82663-6

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6976,9 +6975,14 @@
       version: 3.1.0
     systemd:
       units:
-      - enabled: false
-        name: autofs.service
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+      - name: autofs.service
+        enabled: false
+        mask: true
+      - name: autofs.socket
+        enabled: false
+        mask: true
+

---
+apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6986,12 +6990,8 @@
       version: 3.1.0
     systemd:
       units:
-      - name: autofs.service
-        enabled: false
-        mask: true
-      - name: autofs.socket
-        enabled: false
-        mask: true
+      - enabled: false
+        name: autofs.service

Rule   Disable Booting from USB Devices in Boot Firmware   [ref]

Configure the system boot firmware (historically called BIOS on PC @@ -7268,7 +7268,7 @@ terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled
Identifiers and References

Identifiers:  CCE-82530-7

References:  - CCI-000366, SC-7(10), FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+            CCI-000366, SC-7(10), FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -7282,7 +7282,7 @@
       - name: systemd-coredump.socket
         enabled: false
         mask: true
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
/usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-nerc-cip.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-nerc-cip.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhcos4-guide-nerc-cip.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleNorth American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for Red Hat Enterprise Linux CoreOS
Profile IDxccdf_org.ssgproject.content_profile_nerc-cip

CPE Platforms

  • cpe:/o:redhat:enterprise_linux_coreos:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4   Group contains 52 groups and 241 rules
Group   @@ -561,8 +561,7 @@ on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-82496-1

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -570,9 +569,14 @@
       version: 3.1.0
     systemd:
       units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+      - name: debug-shell.service
+        enabled: false
+        mask: true
+      - name: debug-shell.socket
+        enabled: false
+        mask: true
+

---
+apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -580,12 +584,8 @@
       version: 3.1.0
     systemd:
       units:
-      - name: debug-shell.service
-        enabled: false
-        mask: true
-      - name: debug-shell.socket
-        enabled: false
-        mask: true
+      - enabled: false
+        name: debug-shell.service

Rule   Verify that Interactive Boot is Disabled   [ref]

Red Hat Enterprise Linux CoreOS 4 systems support an "interactive boot" option that can @@ -6653,7 +6653,7 @@ connections to Bluetooth devices, which entails some security risk. Nevertheless, variation in this risk decision may be expected due to the utility of Bluetooth connectivity and its limited range.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_bluetooth_disabled
Identifiers and References

References:  - 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 3.1.16, CCI-000085, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6667,7 +6667,7 @@
       - name: bluetooth.socket
         enabled: false
         mask: true
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6956,8 +6956,7 @@
 Additionally, automatically mounting filesystems permits easy introduction of
 unknown devices, thereby facilitating malicious activity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_autofs_disabled
Identifiers and References

Identifiers:  CCE-82663-6

References:  - 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.4.6, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227



Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6965,9 +6964,14 @@
       version: 3.1.0
     systemd:
       units:
-      - enabled: false
-        name: autofs.service
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+      - name: autofs.service
+        enabled: false
+        mask: true
+      - name: autofs.socket
+        enabled: false
+        mask: true
+

---
+apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -6975,12 +6979,8 @@
       version: 3.1.0
     systemd:
       units:
-      - name: autofs.service
-        enabled: false
-        mask: true
-      - name: autofs.socket
-        enabled: false
-        mask: true
+      - enabled: false
+        name: autofs.service

Rule   Disable Booting from USB Devices in Boot Firmware   [ref]

Configure the system boot firmware (historically called BIOS on PC @@ -7257,7 +7257,7 @@ terminates an application. The memory image could contain sensitive data and is generally useful only for developers trying to debug problems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_systemd-coredump_disabled
Identifiers and References

Identifiers:  CCE-82530-7

References:  - CCI-000366, SC-7(10), FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+            CCI-000366, SC-7(10), FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
@@ -7271,7 +7271,7 @@
       - name: systemd-coredump.socket
         enabled: false
         mask: true
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
 kind: MachineConfig
 spec:
   config:
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-C2S.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-C2S.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-C2S.html	2022-10-05 00:00:00.000000000 +0000
@@ -75,7 +75,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleC2S for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_C2S

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Avahi Server
    2. Base Services
    3. Cron and At Daemons
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Mail Server Software
    11. NFS and RPC
    12. Network Time Protocol
    13. Obsolete Services
    14. Print Support
    15. Proxy Server
    16. Samba(SMB) Microsoft Windows File Sharing Server
    17. SNMP Server
    18. SSH Server
    19. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 101 groups and 234 rules
Group   @@ -120,14 +120,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -137,12 +130,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -5286,21 +5286,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-27294-8

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, 5.5


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -5308,7 +5294,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -5325,6 +5311,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true

Rule   Ensure that System Accounts Do Not Run a Shell Upon Login   [ref]

Some accounts are not associated with a human user of the system, and exist to @@ -27615,21 +27615,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-27290-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -27969,7 +27955,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -28291,6 +28277,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -28315,21 +28315,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

Identifiers:  CCE-27219-5

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -28657,7 +28643,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -28972,6 +28958,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_enhanced

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 61 groups and 165 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -458,14 +458,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82213-0

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -475,12 +468,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -7274,21 +7274,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-27294-8

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, 5.5


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7296,7 +7282,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7313,6 +7299,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -8830,21 +8830,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-80195-1

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8865,7 +8851,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Configure daily log rotation in /etc/logrotate.conf
+

Complexity:low
Disruption:low
Strategy:configure
- name: Configure daily log rotation in /etc/logrotate.conf
   lineinfile:
     create: true
     dest: /etc/logrotate.conf
@@ -8927,6 +8913,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
+        mode: 0644
+        path: /etc/logrotate.conf
+        overwrite: true
Group   Rsyslog Logs Sent To Remote Host   Group contains 3 rules
[ref]   @@ -9083,14 +9083,7 @@ $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-86724-2

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_high

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 61 groups and 179 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -786,14 +786,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82213-0

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -803,12 +796,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -7602,21 +7602,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-27294-8

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, 5.5


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7624,7 +7610,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7641,6 +7627,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -9266,21 +9266,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-80195-1

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -9301,7 +9287,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Configure daily log rotation in /etc/logrotate.conf
+

Complexity:low
Disruption:low
Strategy:configure
- name: Configure daily log rotation in /etc/logrotate.conf
   lineinfile:
     create: true
     dest: /etc/logrotate.conf
@@ -9363,6 +9349,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
+        mode: 0644
+        path: /etc/logrotate.conf
+        overwrite: true
Group   Rsyslog Logs Sent To Remote Host   Group contains 3 rules
[ref]   @@ -9519,14 +9519,7 @@ $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-86724-2

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_intermediary

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 57 groups and 155 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -458,14 +458,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82213-0

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -475,12 +468,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -7274,21 +7274,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-27294-8

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, 5.5


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7296,7 +7282,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7313,6 +7299,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 2 rules
[ref]   @@ -8400,21 +8400,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-80195-1

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8435,7 +8421,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Configure daily log rotation in /etc/logrotate.conf
+

Complexity:low
Disruption:low
Strategy:configure
- name: Configure daily log rotation in /etc/logrotate.conf
   lineinfile:
     create: true
     dest: /etc/logrotate.conf
@@ -8497,6 +8483,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
+        mode: 0644
+        path: /etc/logrotate.conf
+        overwrite: true
Group   Rsyslog Logs Sent To Remote Host   Group contains 3 rules
[ref]   @@ -8653,14 +8653,7 @@ $ sudo yum install rsyslog-gnutls
Rationale:
The rsyslog-gnutls package provides Transport Layer Security (TLS) support for the rsyslog daemon, which enables secure remote logging.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog-gnutls_installed
Identifiers and References

Identifiers:  CCE-86724-2

References:  - BP28(R43), CCI-000366, FTP_ITC_EXT.1.1, SRG-OS-000480-GPOS-00227, SRG-OS-000120-GPOS-00061


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog-gnutls
-
-class install_rsyslog-gnutls {
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-anssi_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_nt28_minimal

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 27 groups and 38 rules
Group   @@ -6372,14 +6372,7 @@   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-80187-8

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6389,12 +6382,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6417,15 +6417,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-80188-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6436,9 +6428,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6562,14 +6562,7 @@
 $ sudo yum erase dhcp
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

Identifiers:  CCE-80331-2

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 2.2.5


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
-
-class remove_dhcp {
-  package { 'dhcp':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp
 #	   from the system, and may remove any packages
 #	   that depend on dhcp. Execute this
@@ -6581,8 +6574,15 @@
     yum remove -y "dhcp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp
+
+class remove_dhcp {
+  package { 'dhcp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp is removed
   package:
     name: dhcp
@@ -6631,14 +6631,7 @@
 its design prevents it from being effectively contained by SELinux.  Postfix
 should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

Identifiers:  CCE-80288-4

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6656,8 +6649,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6707,14 +6707,7 @@
 $ sudo yum erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

Identifiers:  CCE-27354-0

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, 2.1.1


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove xinetd
@@ -6732,8 +6725,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=xinetd
+

Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
+
+class remove_xinetd {
+  package { 'xinetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure xinetd is removed
   package:
     name: xinetd
@@ -6769,14 +6769,7 @@
 Directory Access Protocol (LDAP). It is recommended that the service be
 removed.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_package_ypbind_removed
Identifiers and References

Identifiers:  CCE-27396-1

References:  - BP28(R1), 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 2.3.1


Complexity:low
Disruption:low
Strategy:disable
include remove_ypbind
-
-class remove_ypbind {
-  package { 'ypbind':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ypbind
 #	   from the system, and may remove any packages
 #	   that depend on ypbind. Execute this
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 7 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 106 groups and 290 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -788,14 +788,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82213-0

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -805,12 +798,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -23274,21 +23274,7 @@
 the kernel and potentially introduce malicious code into kernel space. It is important
 to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

Identifiers:  CCE-80415-3

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, RHEL-07-030830, 4.1.16, SV-204562r833175_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -23622,7 +23608,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -23941,6 +23927,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
+        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
+        overwrite: true

Rule   Ensure auditd Collects Information on Kernel Module Loading - init_module   [ref]

To capture kernel module loading events, use following line, setting ARCH to @@ -23958,21 +23958,7 @@ the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init
Identifiers and References

Identifiers:  CCE-80414-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, RHEL-07-030820, 4.1.16, SV-204560r833172_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-init.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -24306,7 +24292,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -24633,6 +24619,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A
+        mode: 0600
+        path: /etc/audit/rules.d/75-kernel-module-loading-init.rules
+        overwrite: true
Group   Record Attempts to Alter Logon and Logout Events   Group contains 2 rules
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-27290-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 7 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 95 groups and 227 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -708,14 +708,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82213-0

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -725,12 +718,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -5586,14 +5586,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-80187-8

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -5603,12 +5596,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -5631,15 +5631,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-80188-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5650,9 +5642,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -5790,14 +5790,7 @@
 Red Hat Enterprise Linux 7 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
 Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_firewalld_installed
Identifiers and References

Identifiers:  CCE-82999-4

References:  - CCI-002314, CM-6(a), FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, 3.5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
-
-class install_firewalld {
-  package { 'firewalld':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-002314, CM-6(a), FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, 3.5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "firewalld" ; then
@@ -5807,12 +5800,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "firewalld"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=firewalld
+

Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
+
+class install_firewalld {
+  package { 'firewalld':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure firewalld is installed
   package:
     name: firewalld
@@ -5835,15 +5835,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 7 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Cron and At Daemons
    2. DHCP
    3. DNS Server
    4. FTP Server
    5. Web Server
    6. IMAP and POP3 Server
    7. LDAP
    8. Mail Server Software
    9. NFS and RPC
    10. Network Time Protocol
    11. Obsolete Services
    12. Proxy Server
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 89 groups and 222 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -708,14 +708,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82213-0

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -725,12 +718,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -5586,14 +5586,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-80187-8

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -5603,12 +5596,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -5631,15 +5631,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-80188-6

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5650,9 +5642,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -5790,14 +5790,7 @@
 Red Hat Enterprise Linux 7 functionality (e.g., SSH) must be capable of taking enforcement action if the audit reveals unauthorized activity.
 Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets)."
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_firewalld_installed
Identifiers and References

Identifiers:  CCE-82999-4

References:  - CCI-002314, CM-6(a), FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, 3.5.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
-
-class install_firewalld {
-  package { 'firewalld':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-002314, CM-6(a), FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000298-GPOS-00116, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00232, 3.5.1.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "firewalld" ; then
@@ -5807,12 +5800,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "firewalld"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=firewalld
+

Complexity:low
Disruption:low
Strategy:enable
include install_firewalld
+
+class install_firewalld {
+  package { 'firewalld':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure firewalld is installed
   package:
     name: firewalld
@@ -5835,15 +5835,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 7 Benchmark for Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. DHCP
    4. DNS Server
    5. FTP Server
    6. Web Server
    7. IMAP and POP3 Server
    8. LDAP
    9. Mail Server Software
    10. NFS and RPC
    11. Network Time Protocol
    12. Obsolete Services
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 104 groups and 288 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -788,14 +788,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82213-0

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.2.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -805,12 +798,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -23274,21 +23274,7 @@
 the kernel and potentially introduce malicious code into kernel space. It is important
 to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

Identifiers:  CCE-80415-3

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, RHEL-07-030830, 4.1.16, SV-204562r833175_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -23622,7 +23608,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -23941,6 +23927,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
+        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
+        overwrite: true

Rule   Ensure auditd Collects Information on Kernel Module Loading - init_module   [ref]

To capture kernel module loading events, use following line, setting ARCH to @@ -23958,21 +23958,7 @@ the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_init
Identifiers and References

Identifiers:  CCE-80414-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, RHEL-07-030820, 4.1.16, SV-204560r833172_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-init.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -24306,7 +24292,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -24633,6 +24619,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20init_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20init_module%20-k%20module-change%0A
+        mode: 0600
+        path: /etc/audit/rules.d/75-kernel-module-loading-init.rules
+        overwrite: true
Group   Record Attempts to Alter Logon and Logout Events   Group contains 2 rules
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-27290-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cjis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
@@ -69,7 +69,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCriminal Justice Information Services (CJIS) Security Policy
Profile IDxccdf_org.ssgproject.content_profile_cjis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 47 groups and 102 rules
Group   @@ -437,14 +437,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -454,12 +447,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -3685,26 +3685,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -3741,7 +3722,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -3862,6 +3843,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 rule
[ref]   @@ -15807,21 +15807,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-27290-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -16161,7 +16147,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -16483,6 +16469,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -16507,21 +16507,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

Identifiers:  CCE-27219-5

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -16849,7 +16835,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -17164,6 +17150,20 @@
   - medium_severity
   - no_reboot_needed
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
@@ -81,7 +81,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleUnclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile IDxccdf_org.ssgproject.content_profile_cui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Base Services
    2. NFS and RPC
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 50 groups and 103 rules
Group   @@ -5148,14 +5148,7 @@

The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

Identifiers:  CCE-27351-6

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -5165,12 +5158,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -5202,26 +5202,7 @@
 on the machine through valid troubleshooting configurations and gaining root
 access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-80206-6

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5241,10 +5222,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -5305,6 +5294,17 @@
   - medium_severity
   - no_reboot_needed
   - service_debug-shell_disabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: false
+        name: debug-shell.service

Rule   Disable Ctrl-Alt-Del Burst Action   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -5323,21 +5323,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Identifiers and References

Identifiers:  CCE-80449-2

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,CtrlAltDelBurstAction%3Dnone
-        mode: 0644
-        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
 # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
@@ -5370,7 +5356,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -5406,6 +5392,20 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,CtrlAltDelBurstAction%3Dnone
+        mode: 0644
+        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
+        overwrite: true

Rule   Disable Ctrl-Alt-Del Reboot Activation   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -5424,18 +5424,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

Identifiers:  CCE-27511-5

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-07-020230, SV-204455r833106_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: ctrl-alt-del.target
-        mask: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 systemctl disable --now ctrl-alt-del.target
@@ -5444,7 +5433,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
   systemd:
     name: ctrl-alt-del.target
     force: true
@@ -5463,6 +5452,17 @@
   - low_complexity
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Obsolete Services
    3. Proxy Server
    4. Network Routing
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 46 groups and 94 rules
Group   @@ -813,23 +813,23 @@ 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Identifiers:  - CCE-82882-2


Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCE-82882-2

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rear" ; then
     yum install -y "rear"
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1400,26 +1400,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1456,7 +1437,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1577,6 +1558,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -8386,21 +8386,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-27290-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -8740,7 +8726,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -9062,6 +9048,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -9086,21 +9086,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

Identifiers:  CCE-27219-5

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -9428,7 +9414,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -9743,6 +9729,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 54 groups and 142 rules
Group   @@ -1285,26 +1285,7 @@ on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-80206-6

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1324,10 +1305,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -1388,6 +1377,17 @@
   - medium_severity
   - no_reboot_needed
   - service_debug-shell_disabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: false
+        name: debug-shell.service

Rule   Disable Ctrl-Alt-Del Burst Action   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1406,21 +1406,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Identifiers and References

Identifiers:  CCE-80449-2

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,CtrlAltDelBurstAction%3Dnone
-        mode: 0644
-        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
 # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
@@ -1453,7 +1439,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -1489,6 +1475,20 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,CtrlAltDelBurstAction%3Dnone
+        mode: 0644
+        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
+        overwrite: true

Rule   Disable Ctrl-Alt-Del Reboot Activation   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1507,18 +1507,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

Identifiers:  CCE-27511-5

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-07-020230, SV-204455r833106_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: ctrl-alt-del.target
-        mask: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 systemctl disable --now ctrl-alt-del.target
@@ -1527,7 +1516,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
   systemd:
     name: ctrl-alt-del.target
     force: true
@@ -1546,6 +1535,17 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: ctrl-alt-del.target
+        mask: true

Rule   Verify that Interactive Boot is Disabled   [ref]

Red Hat Enterprise Linux 7 systems support an "interactive boot" option that can @@ -1781,26 +1781,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ncp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ncp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ncp.html	2022-10-05 00:00:00.000000000 +0000
@@ -92,7 +92,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleNIST National Checklist Program Security Guide
Profile IDxccdf_org.ssgproject.content_profile_ncp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. LDAP
    4. NFS and RPC
    5. Network Time Protocol
    6. Obsolete Services
    7. Network Routing
    8. SSH Server
    9. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 105 groups and 385 rules
Group   @@ -460,14 +460,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -477,12 +470,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -12611,14 +12611,7 @@
 


 The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

Identifiers:  CCE-27351-6

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -12628,12 +12621,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -12673,14 +12673,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

Identifiers:  CCE-80568-9

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -12690,12 +12683,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -12717,14 +12717,7 @@
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

Identifiers:  CCE-82347-6

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -12734,12 +12727,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -12769,15 +12769,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

Identifiers:  CCE-80569-7

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -12788,9 +12780,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["pcscd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
+
+class enable_pcscd {
+  service {'pcscd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service pcscd
   block:
 
@@ -13128,26 +13128,7 @@
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -72,7 +72,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleOSPP - Protection Profile for General Purpose Operating Systems v4.2.1
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Base Services
    2. NFS and RPC
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 50 groups and 103 rules
Group   @@ -5139,14 +5139,7 @@

The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

Identifiers:  CCE-27351-6

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -5156,12 +5149,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -5193,26 +5193,7 @@
 on the machine through valid troubleshooting configurations and gaining root
 access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-80206-6

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5232,10 +5213,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -5296,6 +5285,17 @@
   - medium_severity
   - no_reboot_needed
   - service_debug-shell_disabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: false
+        name: debug-shell.service

Rule   Disable Ctrl-Alt-Del Burst Action   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -5314,21 +5314,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Identifiers and References

Identifiers:  CCE-80449-2

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,CtrlAltDelBurstAction%3Dnone
-        mode: 0644
-        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
 # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
@@ -5361,7 +5347,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -5397,6 +5383,20 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,CtrlAltDelBurstAction%3Dnone
+        mode: 0644
+        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
+        overwrite: true

Rule   Disable Ctrl-Alt-Del Reboot Activation   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -5415,18 +5415,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

Identifiers:  CCE-27511-5

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-07-020230, SV-204455r833106_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: ctrl-alt-del.target
-        mask: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 systemctl disable --now ctrl-alt-del.target
@@ -5435,7 +5424,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
   systemd:
     name: ctrl-alt-del.target
     force: true
@@ -5454,6 +5443,17 @@
   - low_complexity
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 47 groups and 96 rules
Group   @@ -433,14 +433,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -450,12 +443,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -6295,26 +6295,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -6351,7 +6332,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -6472,6 +6453,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   System Accounting with auditd   Group contains 9 groups and 41 rules
[ref]   @@ -18289,21 +18289,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-27290-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -18643,7 +18629,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -18965,6 +18951,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -18989,21 +18989,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

Identifiers:  CCE-27219-5

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -19331,7 +19317,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -19646,6 +19632,20 @@
   - medium_severity
   - no_reboot_needed
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleRHV hardening based on STIG for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_rhelh-stig

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. FTP Server
    4. LDAP
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. Network Routing
    9. SSH Server
    10. System Security Services Daemon
    11. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 100 groups and 377 rules
Group   @@ -562,14 +562,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -579,12 +572,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1995,14 +1995,7 @@
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

Identifiers:  CCE-82348-4

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if rpm --quiet -q gdm; then
 
 # CAUTION: This remediation script will remove gdm
@@ -2020,8 +2013,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=gdm
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
+
+class remove_gdm {
+  package { 'gdm':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -9036,14 +9036,7 @@
 


 The screen package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_screen_installed
Identifiers and References

Identifiers:  CCE-27351-6

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000058, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_screen
-
-class install_screen {
-  package { 'screen':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "screen" ; then
@@ -9053,12 +9046,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "screen"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=screen
+

Complexity:low
Disruption:low
Strategy:enable
include install_screen
+
+class install_screen {
+  package { 'screen':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure screen is installed
   package:
     name: screen
@@ -9098,14 +9098,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

Identifiers:  CCE-80568-9

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -9115,12 +9108,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -9142,14 +9142,7 @@
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

Identifiers:  CCE-82347-6

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -9159,12 +9152,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -9194,15 +9194,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

Identifiers:  CCE-80569-7

References:  /usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-vpp.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-vpp.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rhelh-vpp.html 2022-10-05 00:00:00.000000000 +0000 @@ -90,7 +90,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleVPP - Protection Profile for Virtualization v. 1.0 for Red Hat Virtualization
Profile IDxccdf_org.ssgproject.content_profile_rhelh-vpp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. SSH Server
    2. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 48 groups and 142 rules
Group   @@ -7056,14 +7056,7 @@ as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

Identifiers:  CCE-80568-9

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -7073,12 +7066,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -7100,14 +7100,7 @@
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

Identifiers:  CCE-82347-6

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -7117,12 +7110,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -7152,15 +7152,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

Identifiers:  CCE-80569-7

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -7171,9 +7163,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["pcscd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
+
+class enable_pcscd {
+  service {'pcscd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service pcscd
   block:
 
@@ -8029,26 +8029,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -8085,7 +8066,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -8206,6 +8187,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 5 rules
[ref]   @@ -8304,21 +8304,7 @@ to privileged (root) access via su / sudo. This is required for FISMA Low and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-27294-8

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, 5.5


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rht-ccp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rht-ccp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-rht-ccp.html	2022-10-05 00:00:00.000000000 +0000
@@ -68,7 +68,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleRed Hat Corporate Profile for Certified Cloud Providers (RH CCP)
Profile IDxccdf_org.ssgproject.content_profile_rht-ccp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Base Services
    2. Obsolete Services
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 38 groups and 68 rules
Group   @@ -113,14 +113,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -130,12 +123,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -3797,26 +3797,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -3853,7 +3834,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -3974,6 +3955,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 2 rules
[ref]   @@ -4576,15 +4576,7 @@ by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Identifiers and References

Identifiers:  CCE-80998-8

References:  - 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, RHEL-07-040520, 3.5.1.4, SV-204604r603261_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
-
-class enable_firewalld {
-  service {'firewalld':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -4595,9 +4587,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["firewalld"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
+
+class enable_firewalld {
+  service {'firewalld':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service firewalld
   block:
 
@@ -4688,21 +4688,7 @@
 
blacklist dccp
Rationale:
Disabling DCCP protects the system against exploitation of any flaws in its implementation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_kernel_module_dccp_disabled
Identifiers and References

Identifiers:  CCE-82024-1

References:  - 11, 14, 3, 9, 5.10.1, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.4.6, CCI-001958, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000096-GPOS-00050, SRG-OS-000378-GPOS-00163, RHEL-07-020101, 3.4.1, SV-204450r603261_rule


Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,install%20dccp%20/bin/true%0Ablacklist%20dccp%0A
-        mode: 0644
-        path: /etc/modprobe.d/dccp.conf
-        overwrite: true
-


Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if LC_ALL=C grep -q -m 1 "^install dccp" /etc/modprobe.d/dccp.conf ; then
@@ -4720,7 +4706,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
- name: Ensure kernel module 'dccp' is disabled
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
- name: Ensure kernel module 'dccp' is disabled
   lineinfile:
     create: true
     dest: /etc/modprobe.d/dccp.conf
@@ -4763,6 +4749,20 @@
   - medium_disruption
   - medium_severity
   - reboot_required
+

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,install%20dccp%20/bin/true%0Ablacklist%20dccp%0A
+        mode: 0644
+        path: /etc/modprobe.d/dccp.conf
+        overwrite: true

Rule   Disable SCTP Support /usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-standard.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-standard.html 2022-10-05 00:00:00.000000000 +0000 @@ -67,7 +67,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 28 groups and 51 rules
Group   @@ -865,26 +865,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -921,7 +902,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1042,6 +1023,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 1 rule
[ref]   @@ -12502,21 +12502,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-27290-6

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -12856,7 +12842,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -13178,6 +13164,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -13202,21 +13202,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

Identifiers:  CCE-27219-5

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -13544,7 +13530,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -13859,6 +13845,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
+        overwrite: true

Rule   Record attempts to alter time through settimeofday   [ref]

If the auditd daemon is configured to use the @@ -13883,21 +13883,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday
Identifiers and References

Identifiers:  CCE-27216-1

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20settimeofday%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20settimeofday%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-settimeofday.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. FTP Server
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. SNMP Server
    9. SSH Server
    10. System Security Services Daemon
    11. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 102 groups and 266 rules
Group   @@ -571,14 +571,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -588,12 +581,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -11987,14 +11987,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_install_smartcard_packages
Identifiers and References

Identifiers:  CCE-80519-2

References:  - CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, RHEL-07-041001, SV-204631r603261_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
-
-class install_pam_pkcs11 {
-  package { 'pam_pkcs11':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, RHEL-07-041001, SV-204631r603261_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ! grep -q s390x /proc/sys/kernel/osrelease; }; then
 
 if ! rpm -q --quiet "pam_pkcs11" ; then
@@ -12004,12 +11997,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_pkcs11"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pam_pkcs11
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
+
+class install_pam_pkcs11 {
+  package { 'pam_pkcs11':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_pkcs11 is installed
   package:
     name: pam_pkcs11
@@ -12250,18 +12250,7 @@
 the case of mixed OS environment, this can create the risk of short-term
 loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

Identifiers:  CCE-27511-5

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-07-020230, SV-204455r833106_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: ctrl-alt-del.target
-        mask: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 systemctl disable --now ctrl-alt-del.target
@@ -12270,7 +12259,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
   systemd:
     name: ctrl-alt-del.target
     force: true
@@ -12289,6 +12278,17 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: ctrl-alt-del.target
+        mask: true

Rule   Require Authentication for Single User Mode   [ref]

Single-user mode is intended as a system recovery @@ -12766,26 +12766,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -12822,7 +12803,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -12943,6 +12924,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -36745,21 +36745,7 @@ the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_create
Identifiers and References

Identifiers:  /usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig_gui.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel7-guide-stig_gui.html 2022-10-05 00:00:00.000000000 +0000 @@ -82,7 +82,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG with GUI for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. FTP Server
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. SNMP Server
    9. SSH Server
    10. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 100 groups and 265 rules
Group   @@ -577,14 +577,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-27096-7

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-07-020029, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -594,12 +587,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -11993,14 +11993,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_install_smartcard_packages
Identifiers and References

Identifiers:  CCE-80519-2

References:  - CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, RHEL-07-041001, SV-204631r603261_rule


Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
-
-class install_pam_pkcs11 {
-  package { 'pam_pkcs11':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, RHEL-07-041001, SV-204631r603261_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ! grep -q s390x /proc/sys/kernel/osrelease; }; then
 
 if ! rpm -q --quiet "pam_pkcs11" ; then
@@ -12010,12 +12003,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pam_pkcs11"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pam_pkcs11
+

Complexity:low
Disruption:low
Strategy:enable
include install_pam_pkcs11
+
+class install_pam_pkcs11 {
+  package { 'pam_pkcs11':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pam_pkcs11 is installed
   package:
     name: pam_pkcs11
@@ -12256,18 +12256,7 @@
 the case of mixed OS environment, this can create the risk of short-term
 loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

Identifiers:  CCE-27511-5

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-07-020230, SV-204455r833106_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: ctrl-alt-del.target
-        mask: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 systemctl disable --now ctrl-alt-del.target
@@ -12276,7 +12265,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable Ctrl-Alt-Del Reboot Activation
   systemd:
     name: ctrl-alt-del.target
     force: true
@@ -12295,6 +12284,17 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - name: ctrl-alt-del.target
+        mask: true

Rule   Require Authentication for Single User Mode   [ref]

Single-user mode is intended as a system recovery @@ -12772,26 +12772,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-27286-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-07-010290, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -12828,7 +12809,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -12949,6 +12930,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -36751,21 +36751,7 @@ the kernel and potentially introduce malicious code into kernel space. It is important to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_create
Identifiers and References

Identifiers:  /usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_enhanced.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_enhanced.html 2022-10-05 00:00:00.000000000 +0000 @@ -71,7 +71,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 61 groups and 171 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -458,14 +458,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -475,12 +468,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1068,23 +1068,23 @@
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-82985-3

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7458,21 +7458,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-80840-2

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7480,7 +7466,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7497,6 +7483,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -9115,21 +9115,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-80794-1

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -9150,7 +9136,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 61 groups and 184 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -781,14 +781,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -798,12 +791,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1391,23 +1391,23 @@
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-82985-3

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7781,21 +7781,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-80840-2

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7803,7 +7789,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7820,6 +7806,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -9486,21 +9486,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-80794-1

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -9521,7 +9507,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 57 groups and 160 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -458,14 +458,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -475,12 +468,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1068,23 +1068,23 @@
 $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-82985-3

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7458,21 +7458,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-80840-2

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7480,7 +7466,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7497,6 +7483,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 2 rules
[ref]   @@ -8683,21 +8683,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-80794-1

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7, 4.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8718,7 +8704,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 27 groups and 43 rules
Group   @@ -240,23 +240,23 @@ $ sudo yum install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-82985-3

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     yum install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6655,14 +6655,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-80847-7

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, RHEL-08-030670, 4.2.1.1, SV-230477r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6672,12 +6665,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6701,15 +6701,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-80886-5

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, RHEL-08-010561, 4.2.1.2, SV-230298r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6720,9 +6712,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6847,14 +6847,7 @@
 $ sudo yum erase dhcp-server
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

Identifiers:  CCE-83385-5

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
-
-class remove_dhcp-server {
-  package { 'dhcp-server':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp-server
 #	   from the system, and may remove any packages
 #	   that depend on dhcp-server. Execute this
@@ -6866,8 +6859,15 @@
     yum remove -y "dhcp-server"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp-server
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
+
+class remove_dhcp-server {
+  package { 'dhcp-server':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp-server is removed
   package:
     name: dhcp-server
@@ -6916,14 +6916,7 @@
 its design prevents it from being effectively contained by SELinux.  Postfix
 should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

Identifiers:  CCE-81039-0

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049, RHEL-08-040002, SV-230489r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6941,8 +6934,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6993,14 +6993,7 @@
 $ sudo yum erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

Identifiers:  CCE-80850-1

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, 2.1.1


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 99 groups and 293 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -446,27 +446,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -484,7 +464,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -531,6 +511,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -733,14 +733,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -750,12 +743,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -29726,21 +29726,7 @@
 the kernel and potentially introduce malicious code into kernel space. It is important
 to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

Identifiers:  CCE-80711-5

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, RHEL-08-030390, 4.1.3.19, SV-230446r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -30074,7 +30060,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -30393,6 +30379,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 88 groups and 226 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -446,27 +446,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -484,7 +464,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -531,6 +511,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -653,14 +653,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -670,12 +663,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8699,14 +8699,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-80847-7

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, RHEL-08-030670, 4.2.1.1, SV-230477r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8716,12 +8709,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8745,15 +8745,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-80886-5

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, RHEL-08-010561, 4.2.1.2, SV-230298r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 84 groups and 223 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -446,27 +446,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -484,7 +464,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -531,6 +511,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -653,14 +653,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -670,12 +663,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8699,14 +8699,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo yum install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-80847-7

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, RHEL-08-030670, 4.2.1.1, SV-230477r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8716,12 +8709,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8745,15 +8745,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-80886-5

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, RHEL-08-010561, 4.2.1.2, SV-230298r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
@@ -70,7 +70,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Red Hat Enterprise Linux 8 Benchmark for Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 95 groups and 290 rules
Group   @@ -115,14 +115,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -132,12 +125,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -446,27 +446,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -484,7 +464,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -531,6 +511,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -733,14 +733,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -750,12 +743,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -29726,21 +29726,7 @@
 the kernel and potentially introduce malicious code into kernel space. It is important
 to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

Identifiers:  CCE-80711-5

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970, RHEL-08-030390, 4.1.3.19, SV-230446r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -30074,7 +30060,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -30393,6 +30379,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cjis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cjis.html	2022-10-05 00:00:00.000000000 +0000
@@ -69,7 +69,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCriminal Justice Information Services (CJIS) Security Policy
Profile IDxccdf_org.ssgproject.content_profile_cjis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 48 groups and 105 rules
Group   @@ -429,14 +429,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -446,12 +439,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -760,27 +760,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -798,7 +778,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -845,6 +825,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4161,26 +4161,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-80841-0

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-08-020331, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -4217,7 +4198,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -4338,6 +4319,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 rule
[ref]   @@ -19868,21 +19868,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-80745-3

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
@@ -81,7 +81,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleUnclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile IDxccdf_org.ssgproject.content_profile_cui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
    9. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Kerberos
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. SSH Server
    8. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 62 groups and 210 rules
Group   @@ -126,14 +126,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -143,12 +136,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -437,23 +437,23 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

Identifiers:  CCE-82723-8

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     yum install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -519,27 +519,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -557,7 +537,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -604,6 +584,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1057,14 +1057,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -1074,12 +1067,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1106,23 +1106,23 @@
 from the Red Hat entitlement platform; contains subscription-manager and
 product-id plugins.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-plugin-subscription-manager_installed
Identifiers and References

Identifiers:  CCE-82315-3

References:  - 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-plugin-subscription-manager
-
-class install_dnf-plugin-subscription-manager {
-  package { 'dnf-plugin-subscription-manager':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-plugin-subscription-manager" ; then
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Obsolete Services
    4. Proxy Server
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 48 groups and 98 rules
Group   @@ -584,27 +584,7 @@ the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT:NO-SHA1'
 
 
@@ -622,7 +602,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT:NO-SHA1
   tags:
@@ -669,6 +649,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -964,23 +964,23 @@ 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Identifiers:  - CCE-82883-0


Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCE-82883-0

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rear" ; then
     yum install -y "rear"
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1606,26 +1606,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-80841-0

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-08-020331, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1662,7 +1643,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1783,6 +1764,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -8645,21 +8645,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-80745-3

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -8999,7 +8985,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 54 groups and 137 rules
Group   @@ -463,27 +463,7 @@ the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -501,7 +481,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -548,6 +528,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1439,26 +1439,7 @@ on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-80876-6

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-08-040180, SV-230532r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1478,10 +1459,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -1545,6 +1534,17 @@
   - medium_severity
   - no_reboot_needed
   - service_debug-shell_disabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: false
+        name: debug-shell.service

Rule   Disable Ctrl-Alt-Del Burst Action   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1563,21 +1563,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Identifiers and References

Identifiers:  CCE-80784-2

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227, RHEL-08-040172, SV-230531r627750_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,CtrlAltDelBurstAction%3Dnone
-        mode: 0644
-        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
 # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
@@ -1610,7 +1596,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -1648,6 +1634,20 @@
   - low_complexity
   - low_disruption
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,CtrlAltDelBurstAction%3Dnone
+        mode: 0644
+        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
+        overwrite: true

Rule   Disable Ctrl-Alt-Del Reboot Activation   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1666,18 +1666,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

Identifiers:  CCE-80785-9

References:  /usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ism_o.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ism_o.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ism_o.html 2022-10-05 00:00:00.000000000 +0000 @@ -75,7 +75,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) ISM Official
Profile IDxccdf_org.ssgproject.content_profile_ism_o

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. Obsolete Services
    5. Proxy Server
    6. Network Routing
    7. SNMP Server
    8. SSH Server
    9. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 71 groups and 151 rules
Group   @@ -559,14 +559,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -576,12 +569,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -790,27 +790,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -828,7 +808,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -875,6 +855,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1037,14 +1037,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -1054,12 +1047,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1327,23 +1327,23 @@
 
 $ sudo yum install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Identifiers:  - CCE-82883-0


Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCE-82883-0

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rear" ; then
     yum install -y "rear"
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -6243,26 +6243,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-80841-0

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-08-020331, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -72,7 +72,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProtection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
    9. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Kerberos
    4. Mail Server Software
    5. NFS and RPC
    6. Network Time Protocol
    7. SSH Server
    8. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 62 groups and 210 rules
Group   @@ -117,14 +117,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -134,12 +127,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -428,23 +428,23 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

Identifiers:  CCE-82723-8

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     yum install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -510,27 +510,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -548,7 +528,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -595,6 +575,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1048,14 +1048,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-82214-8

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 5.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -1065,12 +1058,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1097,23 +1097,23 @@
 from the Red Hat entitlement platform; contains subscription-manager and
 product-id plugins.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-plugin-subscription-manager_installed
Identifiers and References

Identifiers:  CCE-82315-3

References:  - 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-plugin-subscription-manager
-
-class install_dnf-plugin-subscription-manager {
-  package { 'dnf-plugin-subscription-manager':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-plugin-subscription-manager" ; then
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 49 groups and 125 rules
Group   @@ -425,14 +425,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -442,12 +435,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -782,27 +782,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -820,7 +800,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -867,6 +847,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -6645,14 +6645,7 @@ as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

Identifiers:  CCE-80846-9

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, RHEL-08-010410, SV-230275r627750_rule


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, RHEL-08-010410, SV-230275r627750_rule

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -6662,12 +6655,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -6690,14 +6690,7 @@
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

Identifiers:  CCE-80993-9

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -6707,12 +6700,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -6742,15 +6742,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

Identifiers:  CCE-80881-6

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-rht-ccp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-rht-ccp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-rht-ccp.html	2022-10-05 00:00:00.000000000 +0000
@@ -68,7 +68,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleRed Hat Corporate Profile for Certified Cloud Providers (RH CCP)
Profile IDxccdf_org.ssgproject.content_profile_rht-ccp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Base Services
    2. Obsolete Services
    3. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 39 groups and 71 rules
Group   @@ -113,14 +113,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -130,12 +123,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -195,27 +195,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -233,7 +213,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -280,6 +260,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4653,26 +4653,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-80841-0

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-08-020331, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -4709,7 +4690,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -4830,6 +4811,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 2 rules
[ref]   @@ -5493,15 +5493,7 @@ by restricting services and known good IP addresses and address ranges. This prevents connections from unknown hosts and protocols.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_firewalld_enabled
Identifiers and References

Identifiers:  CCE-80877-4

References:  - 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, RHEL-08-040101, 3.4.1.4, SV-244544r743881_rule


Complexity:low
Disruption:low
Strategy:enable
include enable_firewalld
-
-class enable_firewalld {
-  service {'firewalld':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5512,9 +5504,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 29 groups and 57 rules
Group   @@ -482,27 +482,7 @@ the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -520,7 +500,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -567,6 +547,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1230,26 +1230,7 @@ run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-80841-0

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, RHEL-08-020331, SV-244540r743869_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1286,7 +1267,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1407,6 +1388,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 1 rule
[ref]   @@ -16353,21 +16353,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-80745-3

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -16707,7 +16693,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -17029,6 +17015,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -17053,21 +17053,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

Identifiers:  CCE-80746-1

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3.4


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Kerberos
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. SSH Server
    11. System Security Services Daemon
    12. USBGuard daemon
    13. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 106 groups and 389 rules
Group   @@ -121,14 +121,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -138,12 +131,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1659,27 +1659,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1697,7 +1677,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1744,6 +1724,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure GnuTLS library to use DoD-approved TLS Encryption   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4940,23 +4940,23 @@ $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

Identifiers:  CCE-82968-9

References:  - CCI-000366, SRG-OS-000480-GPOS-00227, RHEL-08-010472, SV-244527r743830_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227, RHEL-08-010472, SV-244527r743830_rule

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -4977,14 +4977,7 @@
 $ sudo yum erase abrt-addon-ccpp
Rationale:
abrt-addon-ccpp contains hooks for C/C++ crashed programs and abrt's C/C++ analyzer plugin.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed
Identifiers and References

Identifiers:  CCE-82919-2

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
-
-class remove_abrt-addon-ccpp {
-  package { 'abrt-addon-ccpp':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-ccpp
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-ccpp. Execute this
@@ -4996,8 +4989,15 @@
     yum remove -y "abrt-addon-ccpp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-addon-ccpp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
+
+class remove_abrt-addon-ccpp {
+  package { 'abrt-addon-ccpp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-addon-ccpp is removed
   package:
     name: abrt-addon-ccpp
@@ -5018,14 +5018,7 @@
 $ sudo yum erase abrt-addon-kerneloops
Rationale:
abrt-addon-kerneloops contains plugins for collecting kernel crash information and reporter plugin which sends this information to a specified server, usually to kerneloops.org.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed
Identifiers and References

Identifiers:  CCE-82926-7

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-kerneloops
-
-class remove_abrt-addon-kerneloops {
-  package { 'abrt-addon-kerneloops':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-kerneloops
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-kerneloops. Execute this
@@ -5037,8 +5030,15 @@
     yum remove -y "abrt-addon-kerneloops"
 
/usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel8-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
@@ -82,7 +82,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleDISA STIG with GUI for Red Hat Enterprise Linux 8
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8
  • cpe:/o:redhat:enterprise_linux:8.0
  • cpe:/o:redhat:enterprise_linux:8.1
  • cpe:/o:redhat:enterprise_linux:8.2
  • cpe:/o:redhat:enterprise_linux:8.3
  • cpe:/o:redhat:enterprise_linux:8.4
  • cpe:/o:redhat:enterprise_linux:8.5
  • cpe:/o:redhat:enterprise_linux:8.6
  • cpe:/o:redhat:enterprise_linux:8.7
  • cpe:/o:redhat:enterprise_linux:8.8
  • cpe:/o:redhat:enterprise_linux:8.9
  • cpe:/o:redhat:enterprise_linux:8.10

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. FTP Server
    4. Kerberos
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. SSH Server
    11. System Security Services Daemon
    12. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 8   Group contains 104 groups and 386 rules
Group   @@ -127,14 +127,7 @@ 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-80844-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, RHEL-08-010359, 1.3.1, SV-251710r809354_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -144,12 +137,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1665,27 +1665,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-80935-0

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, RHEL-08-010020, 1.10, 1.11, SV-230223r792855_rule


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1703,7 +1683,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1750,6 +1730,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure GnuTLS library to use DoD-approved TLS Encryption   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -4946,23 +4946,23 @@ $ sudo yum install rng-tools
Rationale:
rng-tools provides hardware random number generator tools, such as those used in the formation of x509/PKI certificates.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_rng-tools_installed
Identifiers and References

Identifiers:  CCE-82968-9

References:  - CCI-000366, SRG-OS-000480-GPOS-00227, RHEL-08-010472, SV-244527r743830_rule


Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
-
-class install_rng-tools {
-  package { 'rng-tools':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            CCI-000366, SRG-OS-000480-GPOS-00227, RHEL-08-010472, SV-244527r743830_rule

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "rng-tools" ; then
     yum install -y "rng-tools"
 fi
-


+


 [[packages]]
 name = "rng-tools"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rng-tools
+

Complexity:low
Disruption:low
Strategy:enable
include install_rng-tools
+
+class install_rng-tools {
+  package { 'rng-tools':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rng-tools is installed
   package:
     name: rng-tools
@@ -4983,14 +4983,7 @@
 $ sudo yum erase abrt-addon-ccpp
Rationale:
abrt-addon-ccpp contains hooks for C/C++ crashed programs and abrt's C/C++ analyzer plugin.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-ccpp_removed
Identifiers and References

Identifiers:  CCE-82919-2

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
-
-class remove_abrt-addon-ccpp {
-  package { 'abrt-addon-ccpp':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-ccpp
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-ccpp. Execute this
@@ -5002,8 +4995,15 @@
     yum remove -y "abrt-addon-ccpp"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=abrt-addon-ccpp
+

Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-ccpp
+
+class remove_abrt-addon-ccpp {
+  package { 'abrt-addon-ccpp':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure abrt-addon-ccpp is removed
   package:
     name: abrt-addon-ccpp
@@ -5024,14 +5024,7 @@
 $ sudo yum erase abrt-addon-kerneloops
Rationale:
abrt-addon-kerneloops contains plugins for collecting kernel crash information and reporter plugin which sends this information to a specified server, usually to kerneloops.org.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_abrt-addon-kerneloops_removed
Identifiers and References

Identifiers:  CCE-82926-7

References:  - CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule


Complexity:low
Disruption:low
Strategy:disable
include remove_abrt-addon-kerneloops
-
-class remove_abrt-addon-kerneloops {
-  package { 'abrt-addon-kerneloops':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+            CCI-000381, SRG-OS-000095-GPOS-00049, RHEL-08-040001, SV-230488r627750_rule

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove abrt-addon-kerneloops
 #	   from the system, and may remove any packages
 #	   that depend on abrt-addon-kerneloops. Execute this
@@ -5043,8 +5036,15 @@
     yum remove -y "abrt-addon-kerneloops"
 
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_enhanced.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_enhanced.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (enhanced)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_enhanced

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 61 groups and 162 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -415,14 +415,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -432,12 +425,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -764,23 +764,23 @@
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-83454-9

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7010,21 +7010,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-83625-4

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7032,7 +7018,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7049,6 +7035,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -8593,21 +8593,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-83993-6

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8628,7 +8614,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (high)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_high

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 61 groups and 175 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -692,14 +692,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -709,12 +702,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -1041,23 +1041,23 @@
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-83454-9

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7287,21 +7287,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-83625-4

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7309,7 +7295,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7326,6 +7312,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 6 rules
[ref]   @@ -8918,21 +8918,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-83993-6

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8953,7 +8939,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_intermediary.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_intermediary.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (intermediary)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_intermediary

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Network Time Protocol
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 57 groups and 151 rules
Group   @@ -116,14 +116,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -133,12 +126,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -415,14 +415,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -432,12 +425,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -764,23 +764,23 @@
 $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-83454-9

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -7010,21 +7010,7 @@
 to privileged (root) access via su / sudo. This is required for FISMA Low
 and FISMA Moderate systems.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_no_direct_root_logins
Identifiers and References

Identifiers:  CCE-83625-4

References:  - BP28(R19), 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.1, 3.1.6, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,
-        mode: 0600
-        path: /etc/securetty
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 echo > /etc/securetty
@@ -7032,7 +7018,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Direct root Logins Not Allowed
   copy:
     dest: /etc/securetty
     content: ''
@@ -7049,6 +7035,20 @@
   - no_direct_root_logins
   - no_reboot_needed
   - restrict_strategy
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,
+        mode: 0600
+        path: /etc/securetty
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 2 rules
[ref]   @@ -8169,21 +8169,7 @@ that they fill up the /var/log partition. Valuable logging information could be lost if the /var/log partition becomes full.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_ensure_logrotate_activated
Identifiers and References

Identifiers:  CCE-83993-6

References:  - BP28(R43), NT12(R18), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000366, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.7


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ %23%20see%20%22man%20logrotate%22%20for%20details%0A%23%20rotate%20log%20files%20daily%0Adaily%0A%0A%23%20keep%204%20weeks%20worth%20of%20backlogs%0Arotate%2030%0A%0A%23%20create%20new%20%28empty%29%20log%20files%20after%20rotating%20old%20ones%0Acreate%0A%0A%23%20use%20date%20as%20a%20suffix%20of%20the%20rotated%20file%0Adateext%0A%0A%23%20uncomment%20this%20if%20you%20want%20your%20log%20files%20compressed%0A%23compress%0A%0A%23%20RPM%20packages%20drop%20log%20rotation%20information%20into%20this%20directory%0Ainclude%20/etc/logrotate.d%0A%0A%23%20system-specific%20logs%20may%20be%20also%20be%20configured%20here. }}
-        mode: 0644
-        path: /etc/logrotate.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 LOGROTATE_CONF_FILE="/etc/logrotate.conf"
@@ -8204,7 +8190,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-anssi_bp28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleANSSI-BP-028 (minimal)
Profile IDxccdf_org.ssgproject.content_profile_anssi_bp28_minimal

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. DHCP
    2. Mail Server Software
    3. Obsolete Services

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 27 groups and 43 rules
Group   @@ -234,23 +234,23 @@ $ sudo dnf install dnf-automatic
Rationale:
dnf-automatic is an alternative command line interface (CLI) to dnf upgrade suitable for automatic, regular execution.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed
Identifiers and References

Identifiers:  CCE-83454-9

References:  - BP28(R8), SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
-
-class install_dnf-automatic {
-  package { 'dnf-automatic':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            BP28(R8), SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "dnf-automatic" ; then
     dnf install -y "dnf-automatic"
 fi
-


+


 [[packages]]
 name = "dnf-automatic"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=dnf-automatic
+

Complexity:low
Disruption:low
Strategy:enable
include install_dnf-automatic
+
+class install_dnf-automatic {
+  package { 'dnf-automatic':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure dnf-automatic is installed
   package:
     name: dnf-automatic
@@ -6552,14 +6552,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo dnf install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-84063-7

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -6569,12 +6562,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -6597,15 +6597,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-83989-4

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -6616,9 +6608,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -6742,14 +6742,7 @@
 $ sudo dnf erase dhcp-server
Rationale:
Removing the DHCP server ensures that it cannot be easily or accidentally reactivated and disrupt network operation.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_dhcp_removed
Identifiers and References

Identifiers:  CCE-84240-1

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
-
-class remove_dhcp-server {
-  package { 'dhcp-server':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove dhcp-server
 #	   from the system, and may remove any packages
 #	   that depend on dhcp-server. Execute this
@@ -6761,8 +6754,15 @@
     dnf remove -y "dhcp-server"
 
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=dhcp-server
+

Complexity:low
Disruption:low
Strategy:disable
include remove_dhcp-server
+
+class remove_dhcp-server {
+  package { 'dhcp-server':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure dhcp-server is removed
   package:
     name: dhcp-server
@@ -6811,14 +6811,7 @@
 its design prevents it from being effectively contained by SELinux.  Postfix
 should be used instead.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sendmail_removed
Identifiers and References

Identifiers:  CCE-90830-1

References:  - BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000381, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, SRG-OS-000095-GPOS-00049


Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
-
-class remove_sendmail {
-  package { 'sendmail':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 # CAUTION: This remediation script will remove sendmail
@@ -6836,8 +6829,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=sendmail
+

Complexity:low
Disruption:low
Strategy:disable
include remove_sendmail
+
+class remove_sendmail {
+  package { 'sendmail':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure sendmail is removed
   package:
     name: sendmail
@@ -6887,14 +6887,7 @@
 $ sudo dnf erase xinetd
Rationale:
Removing the xinetd package decreases the risk of the xinetd service's accidental (or intentional) activation.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_xinetd_removed
Identifiers and References

Identifiers:  CCE-84155-1

References:  - BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000305, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_xinetd
-
-class remove_xinetd {
-  package { 'xinetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 99 groups and 285 rules
Group   @@ -112,14 +112,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -129,12 +122,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -442,27 +442,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -480,7 +460,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -525,6 +505,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -726,14 +726,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -743,12 +736,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -29292,21 +29292,7 @@
 the kernel and potentially introduce malicious code into kernel space. It is important
 to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

Identifiers:  CCE-83802-9

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -29640,7 +29626,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -29955,6 +29941,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_server_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_server_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Server
Profile IDxccdf_org.ssgproject.content_profile_cis_server_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 88 groups and 218 rules
Group   @@ -112,14 +112,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -129,12 +122,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -442,27 +442,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -480,7 +460,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -525,6 +505,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -646,14 +646,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -663,12 +656,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8203,14 +8203,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo dnf install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-84063-7

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8220,12 +8213,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8248,15 +8248,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-83989-4

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l1.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l1.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 1 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l1

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 84 groups and 215 rules
Group   @@ -112,14 +112,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -129,12 +122,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -442,27 +442,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -480,7 +460,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -525,6 +505,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -646,14 +646,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -663,12 +656,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -8203,14 +8203,7 @@
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ sudo dnf install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

Identifiers:  CCE-84063-7

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "rsyslog" ; then
@@ -8220,12 +8213,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rsyslog
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -8248,15 +8248,7 @@
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

Identifiers:  CCE-83989-4

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l2.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cis_workstation_l2.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Workstation
Profile IDxccdf_org.ssgproject.content_profile_cis_workstation_l2

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Cron and At Daemons
    2. FTP Server
    3. Web Server
    4. IMAP and POP3 Server
    5. LDAP
    6. Mail Server Software
    7. NFS and RPC
    8. Network Time Protocol
    9. Obsolete Services
    10. Proxy Server
    11. Samba(SMB) Microsoft Windows File Sharing Server
    12. SNMP Server
    13. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 95 groups and 282 rules
Group   @@ -112,14 +112,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -129,12 +122,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -442,27 +442,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -480,7 +460,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -525,6 +505,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -726,14 +726,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -743,12 +736,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -29292,21 +29292,7 @@
 the kernel and potentially introduce malicious code into kernel space. It is important
 to have an audit trail of modules that have been introduced into the kernel.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_kernel_module_loading_delete
Identifiers and References

Identifiers:  CCE-83802-9

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222, SRG-OS-000477-VMM-001970


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
-        mode: 0600
-        path: /etc/audit/rules.d/75-kernel-module-loading-delete.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -29640,7 +29626,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:configure
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -29955,6 +29941,20 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20delete_module%20-k%20module-change%0A-a%20always%2Cexit%20-F%20arch%3Db64%20-S%20delete_module%20-k%20module-change%0A
+        mode: 0600
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-cui.html	2022-10-05 00:00:00.000000000 +0000
@@ -81,7 +81,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)
Profile IDxccdf_org.ssgproject.content_profile_cui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. SSH Server
    5. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 46 groups and 144 rules
Group   @@ -277,23 +277,23 @@ the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

Identifiers:  CCE-83442-4

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -333,27 +333,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -371,7 +351,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -416,6 +396,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure OpenSSL library to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -619,14 +619,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -636,12 +629,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -672,23 +672,23 @@
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

Identifiers:  CCE-83494-5

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
     dnf install -y "gnutls-utils"
 fi
-


+


 [[packages]]
 name = "gnutls-utils"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=gnutls-utils
+

Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -709,23 +709,23 @@
 configuration and vulnerability scanner, capable of performing compliance checking using
 SCAP content.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed
Identifiers and References

Identifiers:  CCE-83502-5

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
-
-class install_openscap-scanner {
-  package { 'openscap-scanner':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "openscap-scanner" ; then
     dnf install -y "openscap-scanner"
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-e8.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-e8.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) Essential Eight
Profile IDxccdf_org.ssgproject.content_profile_e8

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Obsolete Services
    4. Proxy Server
    5. Network Routing
    6. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 48 groups and 98 rules
Group   @@ -449,27 +449,7 @@ the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT:NO-SHA1'
 
 
@@ -487,7 +467,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT:NO-SHA1
   tags:
@@ -532,6 +512,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -820,14 +820,7 @@ 
 $ sudo dnf install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Identifiers:  - CCE-83503-3


Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCE-83503-3

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if ! grep -q aarch64 /proc/sys/kernel/osrelease; then
 
 if ! rpm -q --quiet "rear" ; then
@@ -837,12 +830,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -1437,26 +1437,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-83611-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -1493,7 +1474,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1611,6 +1592,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 1 rule
[ref]   @@ -8441,21 +8441,7 @@ are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

Identifiers:  CCE-83840-9

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-hipaa.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-hipaa.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleHealth Insurance Portability and Accountability Act (HIPAA)
Profile IDxccdf_org.ssgproject.content_profile_hipaa

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. NFS and RPC
    4. Obsolete Services
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 52 groups and 135 rules
Group   @@ -328,27 +328,7 @@ the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -366,7 +346,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -411,6 +391,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -1295,26 +1295,7 @@ on the machine through valid troubleshooting configurations and gaining root access when the system is rebooted.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_debug-shell_disabled
Identifiers and References

Identifiers:  CCE-90724-6

References:  - 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), CM-6, FIA_UAU.1, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - enabled: false
-        name: debug-shell.service
-

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
-
-class disable_debug-shell {
-  service {'debug-shell':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1334,10 +1315,18 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 disabled = ["debug-shell"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
+

Complexity:low
Disruption:low
Strategy:enable
include disable_debug-shell
+
+class disable_debug-shell {
+  service {'debug-shell':
+    enable => false,
+    ensure => 'stopped',
+  }
+}
+

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service debug-shell
   block:
 
   - name: Disable service debug-shell
@@ -1398,6 +1387,17 @@
   - medium_severity
   - no_reboot_needed
   - service_debug-shell_disabled
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+      - enabled: false
+        name: debug-shell.service

Rule   Disable Ctrl-Alt-Del Burst Action   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1416,21 +1416,7 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction
Identifiers and References

Identifiers:  CCE-90308-8

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), CM-6(a), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,CtrlAltDelBurstAction%3Dnone
-        mode: 0644
-        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if rpm --quiet -q systemd; then
 
 # Test if the config_file is a symbolic link. If so, use --follow-symlinks with sed.
@@ -1463,6 +1449,20 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,CtrlAltDelBurstAction%3Dnone
+        mode: 0644
+        path: /etc/systemd/system.conf.d/disable_ctrlaltdelete_burstaction.conf
+        overwrite: true

Rule   Disable Ctrl-Alt-Del Reboot Activation   [ref]

By default, SystemD will reboot the system if the Ctrl-Alt-Del @@ -1481,7 +1481,16 @@ the case of mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot
Identifiers and References

Identifiers:  CCE-86667-3

References:  - 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, FAU_GEN.1.2, SRG-OS-000324-GPOS-00125, SRG-OS-000480-GPOS-00227



# Remediation is applicable only in certain platforms
+if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
+
+systemctl disable --now ctrl-alt-del.target
+systemctl mask --now ctrl-alt-del.target
+
+else
+    >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ism_o.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ism_o.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ism_o.html	2022-10-05 00:00:00.000000000 +0000
@@ -75,7 +75,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleAustralian Cyber Security Centre (ACSC) ISM Official
Profile IDxccdf_org.ssgproject.content_profile_ism_o

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. Avahi Server
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. Obsolete Services
    5. Proxy Server
    6. Network Routing
    7. SNMP Server
    8. SSH Server
    9. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 71 groups and 148 rules
Group   @@ -424,14 +424,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -441,12 +434,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -561,27 +561,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -599,7 +579,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -644,6 +624,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure SSH to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -694,14 +694,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -711,12 +704,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -978,14 +978,7 @@
 
 $ sudo dnf install rear
Rationale:
rear contains the Relax-and-Recover (ReaR) utility. ReaR produces a bootable image of a system and restores from backup using this image.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rear_installed
Identifiers and References

Identifiers:  - CCE-83503-3


Complexity:low
Disruption:low
Strategy:enable
include install_rear
-
-class install_rear {
-  package { 'rear':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCE-83503-3

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if ! grep -q aarch64 /proc/sys/kernel/osrelease; then
 
 if ! rpm -q --quiet "rear" ; then
@@ -995,12 +988,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rear"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=rear
+

Complexity:low
Disruption:low
Strategy:enable
include install_rear
+
+class install_rear {
+  package { 'rear':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rear is installed
   package:
     name: rear
@@ -5824,26 +5824,7 @@
 run commands with the privileges of that account. Accounts with
 empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

Identifiers:  CCE-83611-4

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ospp.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-ospp.html	2022-10-05 00:00:00.000000000 +0000
@@ -71,7 +71,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProtection Profile for General Purpose Operating Systems
Profile IDxccdf_org.ssgproject.content_profile_ospp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. zIPL bootloader configuration
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Application Whitelisting Daemon
    3. Network Time Protocol
    4. SSH Server
    5. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 46 groups and 144 rules
Group   @@ -267,23 +267,23 @@ the applications that run on that operating system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

Identifiers:  CCE-83442-4

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -323,27 +323,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS:OSPP'
 
 
@@ -361,7 +341,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS:OSPP
   tags:
@@ -406,6 +386,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure OpenSSL library to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -609,14 +609,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -626,12 +619,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -662,23 +662,23 @@
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

Identifiers:  CCE-83494-5

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
     dnf install -y "gnutls-utils"
 fi
-


+


 [[packages]]
 name = "gnutls-utils"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=gnutls-utils
+

Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -699,23 +699,23 @@
 configuration and vulnerability scanner, capable of performing compliance checking using
 SCAP content.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed
Identifiers and References

Identifiers:  CCE-83502-5

References:  - AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080


Complexity:low
Disruption:low
Strategy:enable
include install_openscap-scanner
-
-class install_openscap-scanner {
-  package { 'openscap-scanner':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "openscap-scanner" ; then
     dnf install -y "openscap-scanner"
 fi
-


+


/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 9
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 49 groups and 123 rules
Group   @@ -290,14 +290,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -307,12 +300,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -646,27 +646,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='DEFAULT'
 
 
@@ -684,7 +664,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str DEFAULT
   tags:
@@ -729,6 +709,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -6437,14 +6437,7 @@ as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

Identifiers:  CCE-83595-9

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -6454,12 +6447,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -6481,14 +6481,7 @@
 $ sudo dnf install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

Identifiers:  CCE-86280-5

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -6498,12 +6491,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -6533,15 +6533,7 @@
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

Identifiers:  CCE-87907-2

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -77,7 +77,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] DISA STIG for Red Hat Enterprise Linux 9
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. Application Whitelisting Daemon
    4. FTP Server
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. Network Routing
    11. SSH Server
    12. System Security Services Daemon
    13. USBGuard daemon
    14. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 115 groups and 494 rules
Group   @@ -122,14 +122,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -139,12 +132,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1568,23 +1568,23 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

Identifiers:  CCE-83442-4

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -1650,27 +1650,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1688,7 +1668,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1733,6 +1713,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -3761,14 +3761,7 @@ A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

Identifiers:  CCE-83549-6

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if rpm --quiet -q gdm; then
 
 # CAUTION: This remediation script will remove gdm
@@ -3786,8 +3779,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=gdm
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
+
+class remove_gdm {
+  package { 'gdm':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -3857,14 +3857,7 @@
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -3874,12 +3867,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
/usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig_gui.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhel9-guide-stig_gui.html	2022-10-05 00:00:00.000000000 +0000
@@ -83,7 +83,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] DISA STIG with GUI for Red Hat Enterprise Linux 9
Profile IDxccdf_org.ssgproject.content_profile_stig_gui

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:9

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. Application Whitelisting Daemon
    4. FTP Server
    5. Mail Server Software
    6. NFS and RPC
    7. Network Time Protocol
    8. Obsolete Services
    9. Hardware RNG Entropy Gatherer Daemon
    10. Network Routing
    11. SSH Server
    12. System Security Services Daemon
    13. USBGuard daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 9   Group contains 113 groups and 490 rules
Group   @@ -128,14 +128,7 @@ 
 $ sudo dnf install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

Identifiers:  CCE-90843-4

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -145,12 +138,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1574,23 +1574,23 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_crypto-policies_installed
Identifiers and References

Identifiers:  CCE-83442-4

References:  - FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
-
-class install_crypto-policies {
-  package { 'crypto-policies':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "crypto-policies" ; then
     dnf install -y "crypto-policies"
 fi
-


+


 [[packages]]
 name = "crypto-policies"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=crypto-policies
+

Complexity:low
Disruption:low
Strategy:enable
include install_crypto-policies
+
+class install_crypto-policies {
+  package { 'crypto-policies':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure crypto-policies is installed
   package:
     name: crypto-policies
@@ -1656,27 +1656,7 @@
 the applications that run on that operating system. Use of weak or untested encryption algorithms
 undermines the purposes of utilizing encryption to protect data.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_configure_crypto_policy
Identifiers and References

Identifiers:  CCE-83450-7

References:  - 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-        - name: configure-crypto-policy.service
-          enabled: true
-          contents: |
-            [Unit]
-            Before=kubelet.service
-            [Service]
-            Type=oneshot
-            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
-            RemainAfterExit=yes
-            [Install]
-            WantedBy=multi-user.target
-



 var_system_crypto_policy='FIPS'
 
 
@@ -1694,7 +1674,7 @@
 	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
 	false  # end with an error code
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
+

Complexity:low
Disruption:low
Strategy:restrict
- name: XCCDF Value var_system_crypto_policy # promote to variable
   set_fact:
     var_system_crypto_policy: !!str FIPS
   tags:
@@ -1739,6 +1719,26 @@
   - low_disruption
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    systemd:
+      units:
+        - name: configure-crypto-policy.service
+          enabled: true
+          contents: |
+            [Unit]
+            Before=kubelet.service
+            [Service]
+            Type=oneshot
+            ExecStart=update-crypto-policies --set {{.var_system_crypto_policy}}
+            RemainAfterExit=yes
+            [Install]
+            WantedBy=multi-user.target

Rule   Configure Kerberos to use System Crypto Policy   [ref]

Crypto Policies provide a centralized control over crypto algorithms usage of many packages. @@ -3792,14 +3792,7 @@ is to give as few privileges as possible but still allow system users to get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

Identifiers:  CCE-83523-1

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "sudo" ; then
@@ -3809,12 +3802,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=sudo
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -4503,23 +4503,23 @@
 This package contains command line TLS client and server and certificate
 manipulation tools.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gnutls-utils_installed
Identifiers and References

Identifiers:  CCE-83494-5

References:  - FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable

+            FIA_X509_EXT.1, FIA_X509_EXT.2, SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:enable

 if ! rpm -q --quiet "gnutls-utils" ; then
/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Virtualization Host (RHVH)
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8::hypervisor
  • cpe:/a:redhat:enterprise_virtualization_manager:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server
    3. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Virtualization 4   Group contains 45 groups and 116 rules
Group   @@ -414,14 +414,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -431,12 +424,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -5598,14 +5598,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -5615,12 +5608,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -5640,14 +5640,7 @@
 
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -5657,12 +5650,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -5690,15 +5690,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -5709,9 +5701,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["pcscd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
+
+class enable_pcscd {
+  service {'pcscd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service pcscd
   block:
 
@@ -6214,26 +6214,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -6270,7 +6251,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -6385,6 +6366,25 @@
   - medium_disruption
/usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile Title[DRAFT] DISA STIG for Red Hat Virtualization Host (RHVH)
Profile IDxccdf_org.ssgproject.content_profile_rhvh-stig

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8::hypervisor
  • cpe:/a:redhat:enterprise_virtualization_manager:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
    8. SELinux
  2. Services
    1. Base Services
    2. Cron and At Daemons
    3. FTP Server
    4. LDAP
    5. NFS and RPC
    6. Network Time Protocol
    7. Obsolete Services
    8. Network Routing
    9. SSH Server
    10. System Security Services Daemon
    11. X Window System

Checklist

Group   Guide to the Secure Configuration of Red Hat Virtualization 4   Group contains 101 groups and 375 rules
Group   @@ -535,14 +535,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -552,12 +545,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -1671,14 +1671,7 @@
 
$ sudo yum remove gdm
Rationale:
Unnecessary service packages must not be installed to decrease the attack surface of the system. A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if rpm --quiet -q gdm; then
 
 # CAUTION: This remediation script will remove gdm
@@ -1696,8 +1689,15 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:disable

+

Complexity:low
Disruption:low
Strategy:disable

 package --remove=gdm
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
+
+class remove_gdm {
+  package { 'gdm':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -8840,14 +8840,7 @@
 session lock.
 


 The tmux package allows for a session lock to be implemented and configured.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_tmux_installed
Identifiers and References

References:  - 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000058, CCI-000056, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_SMF_EXT.1, FMT_MOF_EXT.1, FTA_SSL.1, SRG-OS-000030-GPOS-00011, SRG-OS-000028-GPOS-00009, SRG-OS-000030-VMM-000110


Complexity:low
Disruption:low
Strategy:enable
include install_tmux
-
-class install_tmux {
-  package { 'tmux':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "tmux" ; then
@@ -8857,12 +8850,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "tmux"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=tmux
+

Complexity:low
Disruption:low
Strategy:enable
include install_tmux
+
+class install_tmux {
+  package { 'tmux':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure tmux is installed
   package:
     name: tmux
@@ -8900,14 +8900,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -8917,12 +8910,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -8942,14 +8942,7 @@
 
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -8959,12 +8952,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -8992,15 +8992,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  /usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-vpp.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-vpp.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-rhv4-guide-rhvh-vpp.html 2022-10-05 00:00:00.000000000 +0000 @@ -90,7 +90,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Profile TitleVPP - Protection Profile for Virtualization v. 1.0 for Red Hat Virtualization Host (RHVH)
Profile IDxccdf_org.ssgproject.content_profile_rhvh-vpp

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:8::hypervisor
  • cpe:/a:redhat:enterprise_virtualization_manager:4

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
    7. SELinux
  2. Services
    1. SSH Server
    2. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Red Hat Virtualization 4   Group contains 49 groups and 144 rules
Group   @@ -7049,14 +7049,7 @@ providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520


Complexity:low
Disruption:low
Strategy:enable
include install_opensc
-
-class install_opensc {
-  package { 'opensc':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "opensc" ; then
@@ -7066,12 +7059,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=opensc
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc
+
+class install_opensc {
+  package { 'opensc':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc is installed
   package:
     name: opensc
@@ -7091,14 +7091,7 @@
 
 $ sudo yum install pcsc-lite
Rationale:
The pcsc-lite package must be installed if it is to be available for multifactor authentication using smartcards.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pcsc-lite_installed
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
-
-class install_pcsc-lite {
-  package { 'pcsc-lite':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "pcsc-lite" ; then
@@ -7108,12 +7101,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "pcsc-lite"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=pcsc-lite
+

Complexity:low
Disruption:low
Strategy:enable
include install_pcsc-lite
+
+class install_pcsc-lite {
+  package { 'pcsc-lite':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure pcsc-lite is installed
   package:
     name: pcsc-lite
@@ -7141,15 +7141,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_pcscd_enabled
Identifiers and References

References:  - CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530


Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
-
-class enable_pcscd {
-  service {'pcscd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, 1382, 1384, 1386, IA-2(1), IA-2(2), IA-2(3), IA-2(4), IA-2(6), IA-2(7), IA-2(11), CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000377-VMM-001530

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -7160,9 +7152,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["pcscd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_pcscd
+
+class enable_pcscd {
+  service {'pcscd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service pcscd
   block:
 
@@ -7893,26 +7893,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -7949,7 +7930,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -8064,6 +8045,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Restrict Root Logins   Group contains 5 rules
[ref]   @@ -45110,26 +45110,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: auditd.service
/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-pci-dss.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-pci-dss.html	2022-10-05 00:00:00.000000000 +0000
@@ -74,7 +74,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitlePCI-DSS v3.2.1 Control Baseline for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_pci-dss

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:scientificlinux:scientificlinux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Network Time Protocol
    2. SSH Server

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 47 groups and 96 rules
Group   @@ -431,14 +431,7 @@   [ref]
The aide package can be installed with the following command: 
 $ sudo yum install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.3.1, SV-251705r833192_rule


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! rpm -q --quiet "aide" ; then
@@ -448,12 +441,19 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
-

Complexity:low
Disruption:low
Strategy:enable

+

Complexity:low
Disruption:low
Strategy:enable

 package --add=aide
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -6175,26 +6175,7 @@
 a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -6231,7 +6212,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -6349,6 +6330,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   System Accounting with auditd   Group contains 9 groups and 41 rules
[ref]   @@ -18085,21 +18085,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -18439,7 +18425,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -18757,6 +18743,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -18780,21 +18780,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -19122,7 +19108,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -19433,6 +19419,20 @@
   - medium_severity
   - no_reboot_needed
/usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-sl7-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -76,7 +76,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Red Hat Enterprise Linux 7
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:redhat:enterprise_linux:7
  • cpe:/o:scientificlinux:scientificlinux:7
  • cpe:/o:redhat:enterprise_linux:7::server
  • cpe:/o:redhat:enterprise_linux:7::client
  • cpe:/o:redhat:enterprise_linux:7::computenode
  • cpe:/o:redhat:enterprise_linux:7::workstation

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Base Services
    2. Cron and At Daemons

Checklist

Group   Guide to the Secure Configuration of Red Hat Enterprise Linux 7   Group contains 28 groups and 51 rules
Group   @@ -850,26 +850,7 @@ a container anyway.
Rationale:
If an account has an empty password, anyone could log in and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_no_empty_passwords
Identifiers and References

References:  - 1, 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(1)(a), IA-5(c), CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, FIA_UAU.1, Req-8.2.3, SRG-OS-000480-GPOS-00227, SV-204424r809187_rule


---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/password-auth
-        overwrite: true
-      - contents:
-          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
-        mode: 0644
-        path: /etc/pam.d/system-auth
-        overwrite: true
-


Complexity:low
Disruption:medium
Strategy:configure
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if [ -f /usr/bin/authselect ]; then
@@ -906,7 +887,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
+

Complexity:low
Disruption:medium
Strategy:configure
- name: Prevent Login to Accounts With Empty Password - Check if system relies on
     authselect
   ansible.builtin.stat:
     path: /usr/bin/authselect
@@ -1024,6 +1005,25 @@
   - medium_disruption
   - no_empty_passwords
   - no_reboot_needed
+

---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/password-auth
+        overwrite: true
+      - contents:
+          source: data:,%23%20Generated%20by%20authselect%20on%20Sat%20Oct%2027%2014%3A59%3A36%202018%0A%23%20Do%20not%20modify%20this%20file%20manually.%0A%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_env.so%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_faildelay.so%20delay%3D2000000%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_fprintd.so%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet%0Aauth%20%20%20%20%20%20%20%20%5Bdefault%3D1%20ignore%3Dignore%20success%3Dok%5D%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20try_first_pass%0Aauth%20%20%20%20%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3E%3D%201000%20quiet_success%0Aauth%20%20%20%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20forward_pass%0Aauth%20%20%20%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_localuser.so%0Aaccount%20%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20uid%20%3C%201000%20quiet%0Aaccount%20%20%20%20%20%5Bdefault%3Dbad%20success%3Dok%20user_unknown%3Dignore%5D%20pam_sss.so%0Aaccount%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_permit.so%0A%0Apassword%20%20%20%20requisite%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_pwquality.so%20try_first_pass%20local_users_only%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%20sha512%20shadow%20try_first_pass%20use_authtok%0Apassword%20%20%20%20sufficient%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%20use_authtok%0Apassword%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_deny.so%0A%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_keyinit.so%20revoke%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_limits.so%0A-session%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_systemd.so%0Asession%20%20%20%20%20%5Bsuccess%3D1%20default%3Dignore%5D%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_succeed_if.so%20service%20in%20crond%20quiet%20use_uid%0Asession%20%20%20%20%20required%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_unix.so%0Asession%20%20%20%20%20optional%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20pam_sss.so%0A
+        mode: 0644
+        path: /etc/pam.d/system-auth
+        overwrite: true
Group   Secure Session Configuration Files for Login Accounts   Group contains 1 group and 1 rule
[ref]   @@ -12400,21 +12400,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_adjtimex
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # Retrieve hardware architecture of the underlying system
@@ -12754,7 +12740,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -13072,6 +13058,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20adjtimex%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20adjtimex%20-k%20audit_time_rules%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-adjtimex.rules
+        overwrite: true

Rule   Record Attempts to Alter Time Through clock_settime   [ref]

If the auditd daemon is configured to use the @@ -13095,21 +13095,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_clock_settime
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then
 
 # First perform the remediation of the syscall rule
@@ -13437,7 +13423,7 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
+

Complexity:low
Disruption:low
Strategy:restrict
- name: Gather the package facts
   package_facts:
     manager: auto
   tags:
@@ -13748,6 +13734,20 @@
   - medium_severity
   - no_reboot_needed
   - restrict_strategy
+

Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
+apiVersion: machineconfiguration.openshift.io/v1
+kind: MachineConfig
+spec:
+  config:
+    ignition:
+      version: 3.1.0
+    storage:
+      files:
+      - contents:
+          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20clock_settime%20-F%20a0%3D0x0%20-k%20time-change%0A }}
+        mode: 0600
+        path: /etc/audit/rules.d/75-syscall-clock-settime.rules
+        overwrite: true
- + - + @@ -89,55 +87,67 @@ - + - + - + + + + + + + @@ -165,20 +175,6 @@ - - - - - - - + /usr/share/doc/scap-security-guide/tables/table-ol7-cuirefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-ol7-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol7-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -44,45 +44,101 @@ - - + + + + + + + + - + + + + + + + + + + + + + @@ -108,21 +164,6 @@ - - - - - - - + - - - - - + + + + + + + + + + + + + + + + + + + - + + + + + + + - + - - - - - - - - + + @@ -113,6 +100,27 @@ + + + + + + - + @@ -159,23 +166,16 @@ - + @@ -210,86 +210,25 @@ - - - - - - - - - - - - - + - + @@ -129,42 +134,37 @@ - + - + - + - + - + - + + + + /usr/share/doc/scap-security-guide/tables/table-ol8-anssirefs.html differs (HTML document, UTF-8 Unicode text) --- old//usr/share/doc/scap-security-guide/tables/table-ol8-anssirefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol8-anssirefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -45,33 +45,31 @@ - + - + @@ -89,55 +87,67 @@ - + - + - + + + + + + + @@ -165,20 +175,6 @@ - - - - - - - + /usr/share/doc/scap-security-guide/tables/table-ol8-cuirefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-ol8-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol8-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -44,45 +44,101 @@ - - + + + + + + + + - + + + + + + + + + + + + + @@ -108,21 +164,6 @@ - - - - - - - + - - - - + + + + + + - + - - + + + + + + + + - + - - + + + + + + + + - + @@ -129,42 +134,37 @@ - + - + - + - + - + - + + + + /usr/share/doc/scap-security-guide/tables/table-rhcos4-nistrefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhcos4-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhcos4-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -74,68 +74,106 @@ + + + + + + - + - - + + + + + + + + - + - - + + + + + + + + - + - + @@ -89,55 +87,67 @@ - + - + - + + + + + + + @@ -165,20 +175,6 @@ - - - - - - - + /usr/share/doc/scap-security-guide/tables/table-rhel7-cisrefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel7-cisrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel7-cisrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -70,31 +70,6 @@ - - - - - - - - + + @@ -160,6 +140,26 @@ + + + + + + - + - + - + - + - + - + /usr/share/doc/scap-security-guide/tables/table-rhel7-cuirefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel7-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel7-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -44,45 +44,101 @@ - - + + + + + + + + - + + + + + + + + + + + + + @@ -108,21 +164,6 @@ - - - - - - - + - - - - - + + + + + + + + + + + + + + + + + + + - + + + + + + + - + - - - - - - - - + + @@ -113,6 +100,27 @@ + + + + + + - + @@ -159,23 +166,16 @@ - + @@ -210,86 +210,25 @@ - - - - - - - - - - - - - + - - - - - - + + + + + + - + - + - + - + - + + + + + + + + + + /usr/share/doc/scap-security-guide/tables/table-rhel8-anssirefs.html differs (HTML document, UTF-8 Unicode text) --- old//usr/share/doc/scap-security-guide/tables/table-rhel8-anssirefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel8-anssirefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -45,33 +45,31 @@ - + - + @@ -89,55 +87,67 @@ - + - + - + + + + + + + @@ -165,20 +175,6 @@ - - - - - - - + /usr/share/doc/scap-security-guide/tables/table-rhel8-cisrefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel8-cisrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel8-cisrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -70,51 +70,51 @@ - + - + @@ -676,6 +676,25 @@ + + + + + + - - + + @@ -751,22 +767,6 @@ - - - - - - - + - + - + /usr/share/doc/scap-security-guide/tables/table-rhel8-cuirefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel8-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel8-cuirefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -44,45 +44,101 @@ - - + + + + + + + + - + + + + + + + + + + + + + @@ -108,21 +164,6 @@ - - - - - - - + - - - - + + + + + + - + - - + + + + + + + + - + - - + + + + + + + + - - - - - - + + + + + + - + - + - + - + - + + + + + + + + + + /usr/share/scap-security-guide/tailoring/rhel7_stig_delta_tailoring.xml differs (ASCII text, with very long lines) --- old//usr/share/scap-security-guide/tailoring/rhel7_stig_delta_tailoring.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/scap-security-guide/tailoring/rhel7_stig_delta_tailoring.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,4 +1,4 @@ -1DISA STIG for Red Hat Enterprise Linux 7 +1DISA STIG for Red Hat Enterprise Linux 7 This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux V3R8. /usr/share/scap-security-guide/tailoring/rhel8_stig_delta_tailoring.xml differs (ASCII text, with very long lines) --- old//usr/share/scap-security-guide/tailoring/rhel8_stig_delta_tailoring.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/scap-security-guide/tailoring/rhel8_stig_delta_tailoring.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,4 +1,4 @@ -1DISA STIG for Red Hat Enterprise Linux 8 +1DISA STIG for Red Hat Enterprise Linux 8 This profile contains configuration checks that align to the DISA STIG for Red Hat Enterprise Linux 8 V1R7. /usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-centos7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -160,7 +160,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -213,19 +213,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -233,9 +238,9 @@ - + - + @@ -243,65 +248,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -309,34 +319,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-centos7-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -162,7 +162,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -215,19 +215,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -235,9 +240,9 @@ - + - + @@ -245,65 +250,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -311,34 +321,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml differs (ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-centos7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,5 +1,5 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -51,19 +51,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -71,9 +76,9 @@ - + - + @@ -81,65 +86,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -147,34 +157,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-centos8-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-centos8-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-centos8-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -208,7 +208,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 8 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 8. It is a rendering of @@ -261,24 +261,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -286,75 +281,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -362,86 +358,90 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-centos8-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -210,7 +210,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 8 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 8. It is a rendering of @@ -263,24 +263,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -288,75 +283,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -364,86 +360,90 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-centos8-xccdf.xml differs (ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-centos8-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-centos8-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,5 +1,5 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 8 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 8. It is a rendering of @@ -51,24 +51,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -76,75 +71,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -152,86 +148,90 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-cs9-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-cs9-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-cs9-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -152,7 +152,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 9 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 9. It is a rendering of @@ -205,15 +205,25 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - + + + + + + + + + + + + @@ -226,65 +236,71 @@ - + - + - + - + - - - - + + + - + - + - + - + - + + + + + + + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -292,24 +308,24 @@ - + - + - + - + - + - + - + - + @@ -317,35 +333,35 @@ - + - - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-cs9-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -154,7 +154,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 9 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 9. It is a rendering of @@ -207,15 +207,25 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - + + + + + + + + + + + + @@ -228,65 +238,71 @@ - + - + - + - + - - - - + + + - + - + - + - + - + + + + + + + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -294,24 +310,24 @@ - + - + - + - + - + - + - + - + @@ -319,35 +335,35 @@ - + - - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-cs9-xccdf.xml differs (ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-cs9-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-cs9-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,5 +1,5 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 9 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 9. It is a rendering of @@ -51,15 +51,25 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - + + + + + + + + + + + + @@ -72,65 +82,71 @@ - + - + - + - + - - - - + + + - + - + - + - + - + + + + + + + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -138,24 +154,24 @@ - + - + - + - + - + - + - + - + @@ -163,35 +179,35 @@ - + - - + - + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-fedora-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-fedora-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-fedora-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -144,7 +144,7 @@ - draft + draft Guide to the Secure Configuration of Fedora This guide presents a catalog of security-relevant configuration settings for Fedora. It is a rendering of @@ -187,19 +187,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + @@ -207,9 +207,9 @@ - + - + @@ -217,39 +217,50 @@ - + + + + + + + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + @@ -262,14 +273,14 @@ - + - + - + - + @@ -277,35 +288,30 @@ - - - - - - - + - + - + - + - + - + + - + - + - + - + @@ -313,20 +319,14 @@ - + - - - - - - - + /usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-fedora-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -144,7 +144,7 @@ - draft + draft Guide to the Secure Configuration of Fedora This guide presents a catalog of security-relevant configuration settings for Fedora. It is a rendering of @@ -187,19 +187,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + @@ -207,9 +207,9 @@ - + - + @@ -217,39 +217,50 @@ - + + + + + + + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + @@ -262,14 +273,14 @@ - + - + - + - + @@ -277,35 +288,30 @@ - - - - - - - + - + - + - + - + - + + - + - + - + - + @@ -313,20 +319,14 @@ - + - - - - - - - + /usr/share/xml/scap/ssg/content/ssg-fedora-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-fedora-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-fedora-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,22 +7,10 @@ 2022-10-05T00:00:00 - - Add nosuid Option to /var/log - - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 - - - - Install rear Package - - ocil:ssg-package_rear_installed_action:testaction:1 - - - - Verify ownership of Message of the Day Banner + + Disable DCCP Support - ocil:ssg-file_owner_etc_motd_action:testaction:1 + ocil:ssg-kernel_module_dccp_disabled_action:testaction:1 @@ -31,10 +19,16 @@ ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Install cryptsetup-luks Package - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1 + + + + Ensure IPv6 is disabled through kernel boot parameter + + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 @@ -43,268 +37,269 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified + + Ensure All Files Are Owned by a User - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Disable X Windows Startup By Setting Default Target + + Install the opensc Package For Multifactor Authentication - ocil:ssg-xwindows_runlevel_target_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Install vim Package + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-package_vim_installed_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Uninstall geolite2-city Package + + Only Authorized Local User Accounts Exist on Operating System - ocil:ssg-package_geolite2-city_removed_action:testaction:1 + ocil:ssg-accounts_authorized_local_users_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Modify the System Login Banner - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Set Interactive Session Timeout + + Record Any Attempts to Run ssh-agent - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1 - - Record Successful Permission Changes to Files - fremovexattr + + Disable storing core dump - ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1 + ocil:ssg-coredump_disable_storage_action:testaction:1 - - Ensure invoking users password for privilege escalation when using sudo + + Ensure auditd Collects Information on Kernel Module Loading and Unloading - ocil:ssg-sudoers_validate_passwd_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - Disable GDM Automatic Login + + Disable vsyscall mapping - ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1 + ocil:ssg-kernel_config_legacy_vsyscall_none_action:testaction:1 - - Add noexec Option to /var/log + + Kernel panic on oops - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Add nodev Option to /var/log - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-mount_option_var_log_nodev_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - init + + Disable vsyscall emulate execution only - ocil:ssg-audit_privileged_commands_init_action:testaction:1 + ocil:ssg-kernel_config_legacy_vsyscall_xonly_action:testaction:1 - - Ensure remote access methods are monitored in Rsyslog + + Ensure cron Is Logging To Rsyslog - ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1 + ocil:ssg-rsyslog_cron_logging_action:testaction:1 - - Enable Dracut FIPS Module + + Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config - ocil:ssg-enable_dracut_fips_module_action:testaction:1 + ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1 - - Drop Gratuitious ARP frames on All IPv4 Interfaces + + Configure System Cryptography Policy - ocil:ssg-sysctl_net_ipv4_conf_all_drop_gratuitous_arp_action:testaction:1 + ocil:ssg-configure_crypto_policy_action:testaction:1 - - Record Successful Delete Attempts to Files - renameat + + Install tar Package - ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1 + ocil:ssg-package_tar_installed_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign + + zero-init everything passed by reference /usr/share/xml/scap/ssg/content/ssg-fedora-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-fedora-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-fedora-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Fedora This guide presents a catalog of security-relevant configuration settings for Fedora. It is a rendering of @@ -43,19 +43,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + @@ -63,9 +63,9 @@ - + - + @@ -73,39 +73,50 @@ - + + + + + + + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + @@ -118,14 +129,14 @@ - + - + - + - + @@ -133,35 +144,30 @@ - - - - - - - + - + - + - + - + - + + - + - + - + - + @@ -169,20 +175,14 @@ - + - - - - - - - + - /usr/share/xml/scap/ssg/content/ssg-ol7-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -136,7 +136,7 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 7 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 7. It is a rendering of @@ -179,19 +179,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -199,9 +204,9 @@ - + - + @@ -209,60 +214,65 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -270,34 +280,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + @@ -305,25 +316,14 @@ - /usr/share/xml/scap/ssg/content/ssg-ol7-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol7-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol7-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -138,7 +138,7 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 7 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 7. It is a rendering of @@ -181,19 +181,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -201,9 +206,9 @@ - + - + @@ -211,60 +216,65 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -272,34 +282,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + @@ -307,25 +318,14 @@ - /usr/share/xml/scap/ssg/content/ssg-ol7-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol7-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol7-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,34 +7,40 @@ 2022-10-05T00:00:00 - - Add nosuid Option to /var/log + + Disable DCCP Support - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 + ocil:ssg-kernel_module_dccp_disabled_action:testaction:1 - - Install rear Package + + Record Unsuccessful Access Attempts to Files - open_by_handle_at - ocil:ssg-package_rear_installed_action:testaction:1 + ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Verify ownership of Message of the Day Banner + + Disable the xserver_object_manager SELinux Boolean - ocil:ssg-file_owner_etc_motd_action:testaction:1 + ocil:ssg-sebool_xserver_object_manager_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - open_by_handle_at + + Install cryptsetup-luks Package - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 + ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Ensure IPv6 is disabled through kernel boot parameter - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 + + + + Uninstall quagga Package + + ocil:ssg-package_quagga_removed_action:testaction:1 @@ -43,400 +49,400 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified + + Ensure All Files Are Owned by a User - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Configure firewalld To Rate Limit Connections + + Install the opensc Package For Multifactor Authentication - ocil:ssg-configure_firewalld_rate_limiting_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Disable X Windows Startup By Setting Default Target + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-xwindows_runlevel_target_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Install vim Package + + Only Authorized Local User Accounts Exist on Operating System - ocil:ssg-package_vim_installed_action:testaction:1 + ocil:ssg-accounts_authorized_local_users_action:testaction:1 - - Uninstall geolite2-city Package + + Modify the System Login Banner - ocil:ssg-package_geolite2-city_removed_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Disable Automatic Bug Reporting Tool (abrtd) - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-service_abrtd_disabled_action:testaction:1 - - Set Interactive Session Timeout + + Disable storing core dump - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-coredump_disable_storage_action:testaction:1 - - Record Successful Permission Changes to Files - fremovexattr + + Ensure auditd Collects Information on Kernel Module Loading and Unloading - ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - Ensure invoking users password for privilege escalation when using sudo + + Kernel panic on oops - ocil:ssg-sudoers_validate_passwd_action:testaction:1 + ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1 - - Disable GDM Automatic Login + + Add nodev Option to /var/log - ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1 + ocil:ssg-mount_option_var_log_nodev_action:testaction:1 - - Add noexec Option to /var/log + + Ensure cron Is Logging To Rsyslog - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-rsyslog_cron_logging_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Disable the logging_syslogd_can_sendmail SELinux Boolean - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-sebool_logging_syslogd_can_sendmail_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - init + + Configure the Firewalld Ports - ocil:ssg-audit_privileged_commands_init_action:testaction:1 + ocil:ssg-configure_firewalld_ports_action:testaction:1 - - All User Files and Directories In The Home Directory Must Have a Valid Owner + + Install tar Package - ocil:ssg-accounts_users_home_files_ownership_action:testaction:1 + ocil:ssg-package_tar_installed_action:testaction:1 - - Verify Group Who Owns /etc/cron.allow file + + Add nosuid Option to /var/tmp - ocil:ssg-file_groupowner_cron_allow_action:testaction:1 + ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1 - - Record Successful Delete Attempts to Files - renameat + /usr/share/xml/scap/ssg/content/ssg-ol7-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 7 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 7. It is a rendering of @@ -43,19 +43,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -63,9 +68,9 @@ - + - + @@ -73,60 +78,65 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -134,34 +144,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + @@ -169,25 +180,14 @@ - - /usr/share/xml/scap/ssg/content/ssg-ol8-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol8-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol8-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -152,7 +152,7 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 8 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 8. It is a rendering of @@ -195,24 +195,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -220,70 +215,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - + + + + + + + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -291,81 +292,80 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol8-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -154,7 +154,7 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 8 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 8. It is a rendering of @@ -197,24 +197,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -222,70 +217,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - + + + + + + + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -293,81 +294,80 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-ol8-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol8-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol8-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,34 +7,34 @@ 2022-10-05T00:00:00 - - Add nosuid Option to /var/log + + Disable DCCP Support - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 + ocil:ssg-kernel_module_dccp_disabled_action:testaction:1 - - Install rear Package + + Record Unsuccessful Access Attempts to Files - open_by_handle_at - ocil:ssg-package_rear_installed_action:testaction:1 + ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Verify ownership of Message of the Day Banner + + Disable the xserver_object_manager SELinux Boolean - ocil:ssg-file_owner_etc_motd_action:testaction:1 + ocil:ssg-sebool_xserver_object_manager_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - open_by_handle_at + + Ensure IPv6 is disabled through kernel boot parameter - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Uninstall quagga Package - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-package_quagga_removed_action:testaction:1 @@ -43,616 +43,611 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified - - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 - - - - Disable X Windows Startup By Setting Default Target + + Ensure All Files Are Owned by a User - ocil:ssg-xwindows_runlevel_target_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Install vim Package + + Install the opensc Package For Multifactor Authentication - ocil:ssg-package_vim_installed_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Uninstall geolite2-city Package + + Configure immutable Audit login UIDs - ocil:ssg-package_geolite2-city_removed_action:testaction:1 + ocil:ssg-audit_immutable_login_uids_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Set Interactive Session Timeout + + Only Authorized Local User Accounts Exist on Operating System - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-accounts_authorized_local_users_action:testaction:1 - - Record Successful Permission Changes to Files - fremovexattr + + SSH client uses strong entropy to seed (for CSH like shells) - ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1 + ocil:ssg-ssh_client_use_strong_rng_csh_action:testaction:1 - - Ensure invoking users password for privilege escalation when using sudo + + Modify the System Login Banner - ocil:ssg-sudoers_validate_passwd_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Disable GDM Automatic Login + + Disable Automatic Bug Reporting Tool (abrtd) - ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1 + ocil:ssg-service_abrtd_disabled_action:testaction:1 - - Add noexec Option to /var/log + + Record Any Attempts to Run ssh-agent - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Disable storing core dump - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-coredump_disable_storage_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - init + + Ensure auditd Collects Information on Kernel Module Loading and Unloading - ocil:ssg-audit_privileged_commands_init_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - All User Files and Directories In The Home Directory Must Have a Valid Owner + + Configure auditing of unsuccessful file creations - ocil:ssg-accounts_users_home_files_ownership_action:testaction:1 + ocil:ssg-audit_create_failed_action:testaction:1 - - Ensure remote access methods are monitored in Rsyslog + + Kernel panic on oops - ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1 + ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1 - - Verify Group Who Owns /etc/cron.allow file + + Add nodev Option to /var/log - ocil:ssg-file_groupowner_cron_allow_action:testaction:1 + ocil:ssg-mount_option_var_log_nodev_action:testaction:1 - - Enable Dracut FIPS Module + + Ensure cron Is Logging To Rsyslog - ocil:ssg-enable_dracut_fips_module_action:testaction:1 + ocil:ssg-rsyslog_cron_logging_action:testaction:1 - - System Audit Directories Must Be Group Owned By Root + /usr/share/xml/scap/ssg/content/ssg-ol8-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol8-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol8-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 8 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 8. It is a rendering of @@ -43,24 +43,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -68,70 +63,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - + + + + + + + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -139,81 +140,80 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-ol9-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol9-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol9-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -128,7 +128,7 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 9 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 9. It is a rendering of @@ -171,10 +171,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + + + + + + + + + + + @@ -182,44 +191,46 @@ - - - + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -227,14 +238,14 @@ - + - + - + - + @@ -242,35 +253,35 @@ - + - - + - + - + - + - + - + - + + - + - + - + - + @@ -278,25 +289,14 @@ - - - - - - - - - - - - + - + - + - + @@ -5344,14 +5344,6 @@ SRG-OS-000363-GPOS-00150 SRG-OS-000445-GPOS-00199 The AIDE package must be installed if it is to be available for integrity checking. /usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol9-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -130,7 +130,7 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 9 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 9. It is a rendering of @@ -173,10 +173,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + + + + + + + + + + + @@ -184,44 +193,46 @@ - - - + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -229,14 +240,14 @@ - + - + - + - + @@ -244,35 +255,35 @@ - + - - + - + - + - + - + - + - + + - + - + - + - + @@ -280,25 +291,14 @@ - - - - - - - - - - - - + - + - + - + @@ -5346,14 +5346,6 @@ SRG-OS-000363-GPOS-00150 SRG-OS-000445-GPOS-00199 The AIDE package must be installed if it is to be available for integrity checking. /usr/share/xml/scap/ssg/content/ssg-ol9-ocil.xml differs (XML 1.0 document, ASCII text) --- old//usr/share/xml/scap/ssg/content/ssg-ol9-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol9-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,364 +7,347 @@ 2022-10-05T00:00:00 - - Add nosuid Option to /var/log - - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 - - - - Install rear Package - - ocil:ssg-package_rear_installed_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - open_by_handle_at ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default - - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 - - Verify User Who Owns /var/log Directory ocil:ssg-file_owner_var_log_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Ensure All Files Are Owned by a User - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Set Interactive Session Timeout + + Install the opensc Package For Multifactor Authentication - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Ensure invoking users password for privilege escalation when using sudo + + Configure immutable Audit login UIDs - ocil:ssg-sudoers_validate_passwd_action:testaction:1 + ocil:ssg-audit_immutable_login_uids_action:testaction:1 - - Disable GDM Automatic Login + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Add noexec Option to /var/log + + Only Authorized Local User Accounts Exist on Operating System - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-accounts_authorized_local_users_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Modify the System Login Banner - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - init + + Disable Automatic Bug Reporting Tool (abrtd) - ocil:ssg-audit_privileged_commands_init_action:testaction:1 + ocil:ssg-service_abrtd_disabled_action:testaction:1 - - Ensure remote access methods are monitored in Rsyslog + + Record Any Attempts to Run ssh-agent - ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1 + ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1 - - Enable Dracut FIPS Module + + Disable storing core dump - ocil:ssg-enable_dracut_fips_module_action:testaction:1 + ocil:ssg-coredump_disable_storage_action:testaction:1 - - System Audit Directories Must Be Group Owned By Root + + Ensure auditd Collects Information on Kernel Module Loading and Unloading - ocil:ssg-directory_group_ownership_var_log_audit_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign + + Configure auditing of unsuccessful file creations - ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1 + ocil:ssg-audit_create_failed_action:testaction:1 - - Uninstall setroubleshoot-plugins Package + + Kernel panic on oops - ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1 + ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1 - - Ensure PAM Displays Last Logon/Access Notification + + Add nodev Option to /var/log - ocil:ssg-display_login_attempts_action:testaction:1 + ocil:ssg-mount_option_var_log_nodev_action:testaction:1 - - Ensure Logrotate Runs Periodically + + Ensure cron Is Logging To Rsyslog - ocil:ssg-ensure_logrotate_activated_action:testaction:1 + ocil:ssg-rsyslog_cron_logging_action:testaction:1 - - Remove tftp Daemon + + Configure the Firewalld Ports - ocil:ssg-package_tftp_removed_action:testaction:1 + ocil:ssg-configure_firewalld_ports_action:testaction:1 - - Configure Polyinstantiation of /var/tmp Directories + + Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config - ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1 + ocil:ssg-harden_sshd_ciphers_openssh_conf_crypto_policy_action:testaction:1 - - Add noexec Option to /var + + Configure System Cryptography Policy - ocil:ssg-mount_option_var_noexec_action:testaction:1 + ocil:ssg-configure_crypto_policy_action:testaction:1 - - Verify iptables Enabled + + Configure kernel to zero out memory before allocation - ocil:ssg-service_iptables_enabled_action:testaction:1 + ocil:ssg-grub2_init_on_alloc_argument_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - creat /usr/share/xml/scap/ssg/content/ssg-ol9-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-ol9-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-ol9-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Oracle Linux 9 This guide presents a catalog of security-relevant configuration settings for Oracle Linux 9. It is a rendering of @@ -43,10 +43,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + + + + + + + + + + + @@ -54,44 +63,46 @@ - - - + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -99,14 +110,14 @@ - + - + - + - + @@ -114,35 +125,35 @@ - + - - + - + - + - + - + - + - + + - + - + - + - + @@ -150,25 +161,14 @@ - - - - - - - - - - - - + - + - + - + @@ -5216,14 +5216,6 @@ SRG-OS-000363-GPOS-00150 SRG-OS-000445-GPOS-00199 The AIDE package must be installed if it is to be available for integrity checking. - include install_aide /usr/share/xml/scap/ssg/content/ssg-rhcos4-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhcos4-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhcos4-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -124,7 +124,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux CoreOS 4. It is a rendering of @@ -167,10 +167,30 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + + + + + + + + + + + + + + + + + + + + + + @@ -182,14 +202,15 @@ - + - + + - + - + @@ -197,29 +218,24 @@ - - - - - - + - + - + - + - + - + - + - + @@ -232,14 +248,14 @@ - + - + - + - + @@ -247,58 +263,42 @@ - + - - + - + - + - + - + + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - 0.1.64 @@ -7234,8 +7234,7 @@ access when the system is rebooted. CCE-82496-1 - --- /usr/share/xml/scap/ssg/content/ssg-rhcos4-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhcos4-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhcos4-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -124,7 +124,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux CoreOS 4. It is a rendering of @@ -167,10 +167,30 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + + + + + + + + + + + + + + + + + + + + + + @@ -182,14 +202,15 @@ - + - + + - + - + @@ -197,29 +218,24 @@ - - - - - - + - + - + - + - + - + - + - + @@ -232,14 +248,14 @@ - + - + - + - + @@ -247,58 +263,42 @@ - + - - + - + - + - + - + + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - 0.1.64 @@ -7234,8 +7234,7 @@ access when the system is rebooted. CCE-82496-1 - --- /usr/share/xml/scap/ssg/content/ssg-rhcos4-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhcos4-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhcos4-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,28 +7,16 @@ 2022-10-05T00:00:00 - - Add nosuid Option to /var/log - - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 - - - - Ensure zIPL bootmap is up to date - - ocil:ssg-zipl_bootmap_is_up_to_date_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - open_by_handle_at ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Ensure IPv6 is disabled through kernel boot parameter - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 @@ -37,268 +25,268 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified + + Configure immutable Audit login UIDs - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 + ocil:ssg-audit_immutable_login_uids_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Set Interactive Session Timeout + + Ensure SELinux Not Disabled in zIPL - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-zipl_enable_selinux_action:testaction:1 - - Add noexec Option to /var/log + + Modify the System Login Banner - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Disable storing core dump - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-coredump_disable_storage_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - init + + Ensure auditd Collects Information on Kernel Module Loading and Unloading - ocil:ssg-audit_privileged_commands_init_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - Enable Dracut FIPS Module + + Configure auditing of unsuccessful file creations - ocil:ssg-enable_dracut_fips_module_action:testaction:1 + ocil:ssg-audit_create_failed_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign + + Kernel panic on oops - ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1 + ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1 - - Ensure IPv6 is disabled through kernel boot parameter + + Add nodev Option to /var/log - ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 + ocil:ssg-mount_option_var_log_nodev_action:testaction:1 - - Uninstall setroubleshoot-plugins Package + + Configure System Cryptography Policy - ocil:ssg-package_setroubleshoot-plugins_removed_action:testaction:1 + ocil:ssg-configure_crypto_policy_action:testaction:1 - - Ensure PAM Displays Last Logon/Access Notification + + Add nosuid Option to /var/tmp - ocil:ssg-display_login_attempts_action:testaction:1 + ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1 - - Ensure Logrotate Runs Periodically + + Record Unsuccessful Ownership Changes to Files - fchown - ocil:ssg-ensure_logrotate_activated_action:testaction:1 + ocil:ssg-audit_rules_unsuccessful_file_modification_fchown_action:testaction:1 - - Configure Polyinstantiation of /var/tmp Directories + + Force kernel panic on uncorrected MCEs - ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1 + ocil:ssg-grub2_mce_argument_action:testaction:1 - - Verify iptables Enabled + + Disable SSH TCP Forwarding - ocil:ssg-service_iptables_enabled_action:testaction:1 + ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - creat + + Set Password Maximum Age - ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1 + ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1 - - Verify User Who Owns shadow File + + Enable checks on linked list manipulation - ocil:ssg-file_owner_etc_shadow_action:testaction:1 + ocil:ssg-kernel_config_debug_list_action:testaction:1 - - Ensure Users Re-Authenticate for Privilege Escalation - sudo + + Ensure that Root's Path Does Not Include World or Group-Writable Directories - ocil:ssg-sudo_require_authentication_action:testaction:1 + ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1 - - Record Unsuccessful Permission Changes to Files - fsetxattr + + Configure session renegotiation for SSH client - ocil:ssg-audit_rules_unsuccessful_file_modification_fsetxattr_action:testaction:1 + ocil:ssg-ssh_client_rekey_limit_action:testaction:1 /usr/share/xml/scap/ssg/content/ssg-rhcos4-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhcos4-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhcos4-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux CoreOS 4 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux CoreOS 4. It is a rendering of @@ -43,10 +43,30 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + + + + + + + + + + + + + + + + + + + + + + @@ -58,14 +78,15 @@ - + - + + - + - + @@ -73,29 +94,24 @@ - - - - - - + - + - + - + - + - + - + - + @@ -108,14 +124,14 @@ - + - + - + - + @@ -123,58 +139,42 @@ - + - - + - + - + - + - + + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - 0.1.64 @@ -7110,8 +7110,7 @@ access when the system is rebooted. CCE-82496-1 - --- -apiVersion: machineconfiguration.openshift.io/v1 /usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -156,7 +156,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -199,19 +199,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -219,9 +224,9 @@ - + - + @@ -229,65 +234,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -295,34 +305,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -158,7 +158,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -201,19 +201,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -221,9 +226,9 @@ - + - + @@ -231,65 +236,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -297,34 +307,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-rhel7-ocil.xml differs (XML 1.0 document, ASCII text) --- old//usr/share/xml/scap/ssg/content/ssg-rhel7-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel7-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,52 +7,46 @@ 2022-10-05T00:00:00 - - Disable the condor_tcp_network_connect SELinux Boolean - - ocil:ssg-sebool_condor_tcp_network_connect_action:testaction:1 - - - - Disable the icecast_use_any_tcp_ports SELinux Boolean + + Disable DCCP Support - ocil:ssg-sebool_icecast_use_any_tcp_ports_action:testaction:1 + ocil:ssg-kernel_module_dccp_disabled_action:testaction:1 - - Disable the pppd_can_insmod SELinux Boolean + + Disable the git_cgi_use_nfs SELinux Boolean - ocil:ssg-sebool_pppd_can_insmod_action:testaction:1 + ocil:ssg-sebool_git_cgi_use_nfs_action:testaction:1 - - Add nosuid Option to /var/log + + Record Unsuccessful Access Attempts to Files - open_by_handle_at - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 + ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Install rear Package + + Disable the xserver_object_manager SELinux Boolean - ocil:ssg-package_rear_installed_action:testaction:1 + ocil:ssg-sebool_xserver_object_manager_action:testaction:1 - - Verify ownership of Message of the Day Banner + + Install cryptsetup-luks Package - ocil:ssg-file_owner_etc_motd_action:testaction:1 + ocil:ssg-package_cryptsetup-luks_installed_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - open_by_handle_at + + Ensure IPv6 is disabled through kernel boot parameter - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Uninstall quagga Package - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-package_quagga_removed_action:testaction:1 @@ -61,556 +55,556 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified + + Ensure All Files Are Owned by a User - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Configure firewalld To Rate Limit Connections + + Install the opensc Package For Multifactor Authentication - ocil:ssg-configure_firewalld_rate_limiting_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Disable X Windows Startup By Setting Default Target + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-xwindows_runlevel_target_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Install vim Package + + Enable the unconfined_mozilla_plugin_transition SELinux Boolean - ocil:ssg-package_vim_installed_action:testaction:1 + ocil:ssg-sebool_unconfined_mozilla_plugin_transition_action:testaction:1 - - Uninstall geolite2-city Package + + Only Authorized Local User Accounts Exist on Operating System - ocil:ssg-package_geolite2-city_removed_action:testaction:1 + ocil:ssg-accounts_authorized_local_users_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Disable the ksmtuned_use_nfs SELinux Boolean - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-sebool_ksmtuned_use_nfs_action:testaction:1 - - Set Interactive Session Timeout + + Modify the System Login Banner - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Record Successful Permission Changes to Files - fremovexattr + + Disable the squid_use_tproxy SELinux Boolean - ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1 + ocil:ssg-sebool_squid_use_tproxy_action:testaction:1 - - Ensure invoking users password for privilege escalation when using sudo + + Disable Automatic Bug Reporting Tool (abrtd) - ocil:ssg-sudoers_validate_passwd_action:testaction:1 + ocil:ssg-service_abrtd_disabled_action:testaction:1 - - Disable the mpd_use_nfs SELinux Boolean + + Disable the named_write_master_zones SELinux Boolean - ocil:ssg-sebool_mpd_use_nfs_action:testaction:1 + ocil:ssg-sebool_named_write_master_zones_action:testaction:1 - - Disable GDM Automatic Login + + Enable the spamd_enable_home_dirs SELinux Boolean - ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1 + ocil:ssg-sebool_spamd_enable_home_dirs_action:testaction:1 - - Add noexec Option to /var/log + + Disable storing core dump - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-coredump_disable_storage_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Ensure auditd Collects Information on Kernel Module Loading and Unloading - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - Disable the mplayer_execstack SELinux Boolean + /usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -43,19 +43,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -63,9 +68,9 @@ - + - + @@ -73,65 +78,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -139,34 +149,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel8-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -204,7 +204,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 8 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 8. It is a rendering of @@ -247,24 +247,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -272,75 +267,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -348,86 +344,90 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -206,7 +206,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 8 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 8. It is a rendering of @@ -249,24 +249,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -274,75 +269,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -350,86 +346,90 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-rhel8-ocil.xml differs (XML 1.0 document, ASCII text) --- old//usr/share/xml/scap/ssg/content/ssg-rhel8-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel8-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,58 +7,40 @@ 2022-10-05T00:00:00 - - Disable the condor_tcp_network_connect SELinux Boolean - - ocil:ssg-sebool_condor_tcp_network_connect_action:testaction:1 - - - - Disable the icecast_use_any_tcp_ports SELinux Boolean - - ocil:ssg-sebool_icecast_use_any_tcp_ports_action:testaction:1 - - - - Disable the pppd_can_insmod SELinux Boolean - - ocil:ssg-sebool_pppd_can_insmod_action:testaction:1 - - - - Add nosuid Option to /var/log + + Disable DCCP Support - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 + ocil:ssg-kernel_module_dccp_disabled_action:testaction:1 - - Install rear Package + + Disable the git_cgi_use_nfs SELinux Boolean - ocil:ssg-package_rear_installed_action:testaction:1 + ocil:ssg-sebool_git_cgi_use_nfs_action:testaction:1 - - Ensure zIPL bootmap is up to date + + Record Unsuccessful Access Attempts to Files - open_by_handle_at - ocil:ssg-zipl_bootmap_is_up_to_date_action:testaction:1 + ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Verify ownership of Message of the Day Banner + + Disable the xserver_object_manager SELinux Boolean - ocil:ssg-file_owner_etc_motd_action:testaction:1 + ocil:ssg-sebool_xserver_object_manager_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - open_by_handle_at + + Ensure IPv6 is disabled through kernel boot parameter - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Uninstall quagga Package - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-package_quagga_removed_action:testaction:1 @@ -67,2350 +49,2351 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified + + Ensure All Files Are Owned by a User - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Disable X Windows Startup By Setting Default Target + + Install the opensc Package For Multifactor Authentication - ocil:ssg-xwindows_runlevel_target_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Install vim Package + + Configure immutable Audit login UIDs - ocil:ssg-package_vim_installed_action:testaction:1 + ocil:ssg-audit_immutable_login_uids_action:testaction:1 - - Uninstall geolite2-city Package + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-package_geolite2-city_removed_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Enable the unconfined_mozilla_plugin_transition SELinux Boolean - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-sebool_unconfined_mozilla_plugin_transition_action:testaction:1 - - Set Interactive Session Timeout + + Only Authorized Local User Accounts Exist on Operating System - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-accounts_authorized_local_users_action:testaction:1 - - Record Successful Permission Changes to Files - fremovexattr + + Disable the ksmtuned_use_nfs SELinux Boolean - ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1 + ocil:ssg-sebool_ksmtuned_use_nfs_action:testaction:1 - - Ensure invoking users password for privilege escalation when using sudo + + Ensure SELinux Not Disabled in zIPL - ocil:ssg-sudoers_validate_passwd_action:testaction:1 + ocil:ssg-zipl_enable_selinux_action:testaction:1 - - Disable the mpd_use_nfs SELinux Boolean + + SSH client uses strong entropy to seed (for CSH like shells) - ocil:ssg-sebool_mpd_use_nfs_action:testaction:1 + ocil:ssg-ssh_client_use_strong_rng_csh_action:testaction:1 - - Disable GDM Automatic Login + + Modify the System Login Banner - ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Add noexec Option to /var/log + + Disable the squid_use_tproxy SELinux Boolean - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-sebool_squid_use_tproxy_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Disable Automatic Bug Reporting Tool (abrtd) - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-service_abrtd_disabled_action:testaction:1 - - Disable the mplayer_execstack SELinux Boolean + + Disable the named_write_master_zones SELinux Boolean - ocil:ssg-sebool_mplayer_execstack_action:testaction:1 + ocil:ssg-sebool_named_write_master_zones_action:testaction:1 /usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel8-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 8 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 8. It is a rendering of @@ -43,24 +43,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + - + - + @@ -68,75 +63,76 @@ - - - - - - + - + - + - + - + - + - + - + - + - + - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + @@ -144,86 +140,90 @@ - + - + - + - + - + - - + - + - + - + - + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel9-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -148,7 +148,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 9 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 9. It is a rendering of @@ -191,15 +191,25 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - + + + + + + + + + + + + @@ -212,65 +222,71 @@ - + - + - + - + - - - - + + + - + - + - + - + - + + + + + + + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -278,24 +294,24 @@ - + - + - + - + - + - + - + - + @@ -303,35 +319,35 @@ - + - - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -150,7 +150,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 9 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 9. It is a rendering of @@ -193,15 +193,25 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - + + + + + + + + + + + + @@ -214,65 +224,71 @@ - + - + - + - + - - - - + + + - + - + - + - + - + + + + + + + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -280,24 +296,24 @@ - + - + - + - + - + - + - + - + @@ -305,35 +321,35 @@ - + - - + - + - + - + - + - /usr/share/xml/scap/ssg/content/ssg-rhel9-ocil.xml differs (XML 1.0 document, ASCII text) --- old//usr/share/xml/scap/ssg/content/ssg-rhel9-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel9-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,52 +7,46 @@ 2022-10-05T00:00:00 - - Disable the condor_tcp_network_connect SELinux Boolean - - ocil:ssg-sebool_condor_tcp_network_connect_action:testaction:1 - - - - Disable the icecast_use_any_tcp_ports SELinux Boolean + + Disable DCCP Support - ocil:ssg-sebool_icecast_use_any_tcp_ports_action:testaction:1 + ocil:ssg-kernel_module_dccp_disabled_action:testaction:1 - - Disable the pppd_can_insmod SELinux Boolean + + Configure auditing of successful file deletions (ppc64le) - ocil:ssg-sebool_pppd_can_insmod_action:testaction:1 + ocil:ssg-audit_delete_success_ppc64le_action:testaction:1 - - Add nosuid Option to /var/log + + Disable the git_cgi_use_nfs SELinux Boolean - ocil:ssg-mount_option_var_log_nosuid_action:testaction:1 + ocil:ssg-sebool_git_cgi_use_nfs_action:testaction:1 - - Install rear Package + + Record Unsuccessful Access Attempts to Files - open_by_handle_at - ocil:ssg-package_rear_installed_action:testaction:1 + ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Ensure zIPL bootmap is up to date + + Disable the xserver_object_manager SELinux Boolean - ocil:ssg-zipl_bootmap_is_up_to_date_action:testaction:1 + ocil:ssg-sebool_xserver_object_manager_action:testaction:1 - - Record Unsuccessful Access Attempts to Files - open_by_handle_at + + Ensure IPv6 is disabled through kernel boot parameter - ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Uninstall quagga Package - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-package_quagga_removed_action:testaction:1 @@ -61,2146 +55,2141 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified - - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 - - - - Disable X Windows Startup By Setting Default Target + + Ensure All Files Are Owned by a User - ocil:ssg-xwindows_runlevel_target_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Uninstall geolite2-city Package + + Install the opensc Package For Multifactor Authentication - ocil:ssg-package_geolite2-city_removed_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Configure immutable Audit login UIDs - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-audit_immutable_login_uids_action:testaction:1 - - Set Interactive Session Timeout + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Record Successful Permission Changes to Files - fremovexattr + + Enable the unconfined_mozilla_plugin_transition SELinux Boolean - ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1 + ocil:ssg-sebool_unconfined_mozilla_plugin_transition_action:testaction:1 - - Ensure invoking users password for privilege escalation when using sudo + + Only Authorized Local User Accounts Exist on Operating System - ocil:ssg-sudoers_validate_passwd_action:testaction:1 + ocil:ssg-accounts_authorized_local_users_action:testaction:1 - - Disable the mpd_use_nfs SELinux Boolean + + Disable the ksmtuned_use_nfs SELinux Boolean - ocil:ssg-sebool_mpd_use_nfs_action:testaction:1 + ocil:ssg-sebool_ksmtuned_use_nfs_action:testaction:1 - - Disable GDM Automatic Login + + Ensure SELinux Not Disabled in zIPL - ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1 + ocil:ssg-zipl_enable_selinux_action:testaction:1 - - Add noexec Option to /var/log + + Modify the System Login Banner - ocil:ssg-mount_option_var_log_noexec_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Disable the squid_use_tproxy SELinux Boolean - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-sebool_squid_use_tproxy_action:testaction:1 - - Disable the mplayer_execstack SELinux Boolean + + Disable the named_write_master_zones SELinux Boolean - ocil:ssg-sebool_mplayer_execstack_action:testaction:1 + ocil:ssg-sebool_named_write_master_zones_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - init + + Enable the spamd_enable_home_dirs SELinux Boolean - ocil:ssg-audit_privileged_commands_init_action:testaction:1 + ocil:ssg-sebool_spamd_enable_home_dirs_action:testaction:1 - - Ensure remote access methods are monitored in Rsyslog + + Record Any Attempts to Run ssh-agent - ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1 /usr/share/xml/scap/ssg/content/ssg-rhel9-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhel9-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhel9-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 9 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 9. It is a rendering of @@ -43,15 +43,25 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - + + + + + + + + + + + + @@ -64,65 +74,71 @@ - + - + - + - + - - - - + + + - + - + - + - + - + + + + + + + - + + - + - + - + - + - + - + - + - + - + - + - + - + @@ -130,24 +146,24 @@ - + - + - + - + - + - + - + - + @@ -155,35 +171,35 @@ - + - - + - + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-rhv4-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhv4-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhv4-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -128,7 +128,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Virtualization 4 This guide presents a catalog of security-relevant configuration settings for Red Hat Virtualization 4. It is a rendering of @@ -171,13 +171,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - - - - + + + + + + + + + + + @@ -185,64 +191,69 @@ - + - + - + - + - - - + + + + - + - + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -250,29 +261,29 @@ - + - + - + - + - + - + - + - + - + - + @@ -280,25 +291,14 @@ - - - - - - - - - - - - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-rhv4-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhv4-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhv4-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -128,7 +128,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Virtualization 4 This guide presents a catalog of security-relevant configuration settings for Red Hat Virtualization 4. It is a rendering of @@ -171,13 +171,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - - - - + + + + + + + + + + + @@ -185,64 +191,69 @@ - + - + - + - + - - - + + + + - + - + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -250,29 +261,29 @@ - + - + - + - + - + - + - + - + - + - + @@ -280,25 +291,14 @@ - - - - - - - - - - - - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-rhv4-ocil.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhv4-ocil.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhv4-ocil.xml 2022-10-05 00:00:00.000000000 +0000 @@ -7,10 +7,10 @@ 2022-10-05T00:00:00 - - Verify ownership of Message of the Day Banner + + Disable DCCP Support - ocil:ssg-file_owner_etc_motd_action:testaction:1 + ocil:ssg-kernel_module_dccp_disabled_action:testaction:1 @@ -19,10 +19,16 @@ ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1 - - Disable Accepting Router Advertisements on all IPv6 Interfaces by Default + + Disable the xserver_object_manager SELinux Boolean - ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1 + ocil:ssg-sebool_xserver_object_manager_action:testaction:1 + + + + Ensure IPv6 is disabled through kernel boot parameter + + ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 @@ -31,604 +37,604 @@ ocil:ssg-file_owner_var_log_action:testaction:1 - - The Installed Operating System Is FIPS 140-2 Certified + + Ensure All Files Are Owned by a User - ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1 + ocil:ssg-no_files_unowned_by_user_action:testaction:1 - - Disable X Windows Startup By Setting Default Target + + Install the opensc Package For Multifactor Authentication - ocil:ssg-xwindows_runlevel_target_action:testaction:1 + ocil:ssg-package_opensc_installed_action:testaction:1 - - Install vim Package + + Ensure auditd Collects Information on Kernel Module Unloading - delete_module - ocil:ssg-package_vim_installed_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1 - - Verify that Interactive Boot is Disabled + + Modify the System Login Banner - ocil:ssg-grub2_disable_interactive_boot_action:testaction:1 + ocil:ssg-banner_etc_issue_action:testaction:1 - - Set Interactive Session Timeout + + Disable storing core dump - ocil:ssg-accounts_tmout_action:testaction:1 + ocil:ssg-coredump_disable_storage_action:testaction:1 - - Record Successful Permission Changes to Files - fremovexattr + + Ensure auditd Collects Information on Kernel Module Loading and Unloading - ocil:ssg-audit_rules_successful_file_modification_fremovexattr_action:testaction:1 + ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1 - - Configure auditd Disk Error Action on Disk Error + + Kernel panic on oops - ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1 + ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - init + + Ensure cron Is Logging To Rsyslog - ocil:ssg-audit_privileged_commands_init_action:testaction:1 + ocil:ssg-rsyslog_cron_logging_action:testaction:1 - - All User Files and Directories In The Home Directory Must Have a Valid Owner + + Disable the logging_syslogd_can_sendmail SELinux Boolean - ocil:ssg-accounts_users_home_files_ownership_action:testaction:1 + ocil:ssg-sebool_logging_syslogd_can_sendmail_action:testaction:1 - - Verify Group Who Owns /etc/cron.allow file + + Configure the Firewalld Ports - ocil:ssg-file_groupowner_cron_allow_action:testaction:1 + ocil:ssg-configure_firewalld_ports_action:testaction:1 - - Enable Dracut FIPS Module + + Configure System Cryptography Policy - ocil:ssg-enable_dracut_fips_module_action:testaction:1 + ocil:ssg-configure_crypto_policy_action:testaction:1 - - Record Successful Delete Attempts to Files - renameat + + Install tar Package - ocil:ssg-audit_rules_successful_file_modification_renameat_action:testaction:1 + ocil:ssg-package_tar_installed_action:testaction:1 - - Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign + + Enable cron Service - ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1 + ocil:ssg-service_crond_enabled_action:testaction:1 - - Ensure IPv6 is disabled through kernel boot parameter + + Verify /boot/grub2/grub.cfg User Ownership - ocil:ssg-grub2_ipv6_disable_argument_action:testaction:1 + ocil:ssg-file_owner_grub2_cfg_action:testaction:1 - - Ensure rsyncd service is diabled + + Force kernel panic on uncorrected MCEs - ocil:ssg-service_rsyncd_disabled_action:testaction:1 + ocil:ssg-grub2_mce_argument_action:testaction:1 - - Ensure PAM Displays Last Logon/Access Notification + + Disable SSH TCP Forwarding - ocil:ssg-display_login_attempts_action:testaction:1 + ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1 - - Ensure Logrotate Runs Periodically + + Verify User Who Owns /etc/cron.allow file - ocil:ssg-ensure_logrotate_activated_action:testaction:1 + ocil:ssg-file_owner_cron_allow_action:testaction:1 - - Configure Polyinstantiation of /var/tmp Directories + + Disable the selinuxuser_tcp_server SELinux Boolean - ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1 + ocil:ssg-sebool_selinuxuser_tcp_server_action:testaction:1 /usr/share/xml/scap/ssg/content/ssg-rhv4-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-rhv4-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-rhv4-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,6 +1,6 @@ - draft + draft Guide to the Secure Configuration of Red Hat Virtualization 4 This guide presents a catalog of security-relevant configuration settings for Red Hat Virtualization 4. It is a rendering of @@ -43,13 +43,19 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - - - - + + + + + + + + + + + @@ -57,64 +63,69 @@ - + - + - + - + - - - + + + + - + - + + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + @@ -122,29 +133,29 @@ - + - + - + - + - + - + - + - + - + - + @@ -152,25 +163,14 @@ - - - - - - - - - - - - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-sl7-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-sl7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-sl7-ds-1.2.xml 2022-10-05 00:00:00.000000000 +0000 @@ -160,7 +160,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -213,19 +213,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -233,9 +238,9 @@ - + - + @@ -243,65 +248,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -309,34 +319,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-sl7-ds.xml differs (XML 1.0 document, ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-sl7-ds.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-sl7-ds.xml 2022-10-05 00:00:00.000000000 +0000 @@ -162,7 +162,7 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -215,19 +215,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -235,9 +240,9 @@ - + - + @@ -245,65 +250,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -311,34 +321,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + /usr/share/xml/scap/ssg/content/ssg-sl7-xccdf.xml differs (ASCII text, with very long lines) --- old//usr/share/xml/scap/ssg/content/ssg-sl7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/xml/scap/ssg/content/ssg-sl7-xccdf.xml 2022-10-05 00:00:00.000000000 +0000 @@ -1,5 +1,5 @@ - draft + draft Guide to the Secure Configuration of Red Hat Enterprise Linux 7 This guide presents a catalog of security-relevant configuration settings for Red Hat Enterprise Linux 7. It is a rendering of @@ -51,19 +51,24 @@ countries. All other names are registered trademarks or trademarks of their respective companies. - + - - + - + - - - - - + + + + + + + + + + + @@ -71,9 +76,9 @@ - + - + @@ -81,65 +86,70 @@ - - - + + + + - + - + - + - + + + + + - + - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - + @@ -147,34 +157,35 @@ - + - + - + - + - + - + - + - + + - + - + - + - + RPMS.2017/scap-security-guide-ubuntu-0.1.64-0.0.noarch.rpm RPMS/scap-security-guide-ubuntu-0.1.64-0.0.noarch.rpm differ: byte 225, line 1 Comparing scap-security-guide-ubuntu-0.1.64-0.0.noarch.rpm to scap-security-guide-ubuntu-0.1.64-0.0.noarch.rpm comparing the rpm tags of scap-security-guide-ubuntu --- old-rpm-tags +++ new-rpm-tags @@ -195,4 +195,4 @@ -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_average.html b5495f1703f98aaf30e745c30571e700ff9c42d14c443c770760613ff43b86c7 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_high.html 5e1f3089ea2bf30bdc9754e115e5ba13d1a1dc3a3941c4ffc1bc5bcd79d75056 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_minimal.html 8dacf95f05560b9fc002aa7470f7499450390090fb514487536e08f5775b2042 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_restrictive.html 30076dca8cece57a251f28ef172c8636e66882e7a1054f2d31dc92093c679ba7 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_average.html fcb71c98b12606d762c90c1475ec19ac8ee8d6d1a27f5870dd1afbd793c412cb 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_high.html 034724e71615cb912cea9ef7d6cbb212bd2a9cc425bd5ba157ed109093b60e2f 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_minimal.html 15af914089eb934aed9952b628fb1a63e443dc0b41ca9f06783345e59cd97f1a 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_restrictive.html b202c302db9d6545954317dd117b2c63f55a66f9af1c52e77e8ae73b10f9ef2d 2 @@ -200,6 +200,6 @@ -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-standard.html c4102ba257e357be912ee93410d64cf043422ebf86bdd25637b5e33bed2bf82b 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_average.html 59bdc13eddba5a1c24e84736cb6c39f57e5d54c09494606aefd5818b078c7cc6 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_high.html a7ac5f510cfdc64c6c5938ec3d0d25cddd892629ec92351b6a72d7b09afff3d0 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_minimal.html ea7fde2a0f5c85f62b90c2ff5abc716b1e14dc4fe5b22f002b4bda028c1c285c 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_restrictive.html 4beb85bdab78035773e2338fa64a6340172007002d6423b2fde14f8baf9c6e4e 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-cis.html 2642257401747298c812a7fc1bff7207e10ffc502cf37ffbb01b0521454ea21d 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-standard.html 50822179736c0c50a55a5f9baa6e9718e129463cf599ea61e39febddbea3dec9 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_average.html 593908c8e29a1765fad4865b400cba2ad8efc2e76b99a364876e68d765b1dd4f 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_high.html 6cd45f13b343085c6a153de9495376f3bdd5d79020ad0d0e6156763c40b6c1be 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_minimal.html 634519ce90d5f963feb785471520aebf6a9acc4ea85d441b756d5dc342cbadb6 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_restrictive.html a48ecf6c53d1e77c4f81c360d8511e8aab004deab21ba219cbec11cf234bee74 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-cis.html 0626f30964d0ca5ccd53129aed79bdbc0af9c702308cc3f2580023867440f64b 2 @@ -207,5 +207,5 @@ -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-standard.html c66bc7a7ab786fa3ea68984d23b4f621d1410352991e20a6fa697838e9131989 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_server.html 5883be513810397f29666b43dffedaf4062fca073dc5992c185829027ad0c53c 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_workstation.html 60028ab73e19de88f081a4cc9f07b9630b01a86ca27d196fb34647e5a0a695b0 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_server.html 82468e8a2b2f7862c7fb55120b1e53f460ecb3690aa474dc09e459d9bad7a07e 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_workstation.html 0abf60733c6a4abbc5a982b821e453efa79000ea84520774a7621540f9bea3c9 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-standard.html 6caf77a7b99a533a05a479e516ef1f5712d417e9a68dd313cbdfece29032c38e 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_server.html cb4bf0169c67c68e037d13552be1858716da8214ea5f32cbd49ccf06d178d473 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_workstation.html 8f1da37706aa22e3bcebf0709a9489a2f71ee27c5c163e686aa27d145c003f01 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_server.html 7abfe65537ced5278b175feb965a1436f1d49c064486f5a2c9627495d797d003 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_workstation.html 50799f05ed4086dbb4ee98ec02f5198a2c29ffaf6a43fead895ad7ddb9aa2365 2 @@ -213,6 +213,6 @@ -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-standard.html b0fc1c46f5022c0a38d5487b5fce99b5f332547f3122647ca219d46ca2b313c3 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-stig.html f41e6342e993b0175cc9dde9a0f1c27edb4c084ee47f8727d7ae4d84bbbd925d 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_server.html 6e0e2826029c3a2d7c12d71ad43126396729179911c3933dbff032daeaefe0ca 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_workstation.html b4d66fdf36f14e12eb2c62fc619a07db5a63584d2bbaecece0413ec8e0dfd27b 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_server.html 726b18ff1fec154829b2f08253be9887bfc3bb6bccc54cd097fd77a53bb37bb6 2 -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_workstation.html 079d9ef368cf9205ebdb092ccb91ed2370585bd58d1dae6e6b0e966d8e4595b9 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-standard.html 6f68e1af1265726b17d9b65c4bb978885a754525ace521948c5ad41f0a6721b3 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-stig.html e446efbfde4a698724fce0b010fb271bd91c177bebc416a97bce0dda464b4a77 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_server.html 4ad01bee8d0c7fd4464e558e8a6d543088ac99c53ea818b9ea7743168c421469 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_workstation.html f5e03de658288d2ecfc5e1e0d32fdf37629b2ca0179a661902fbca04ef3dfcbf 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_server.html f6fd09b426c6a28b771e07b8e6693bff2361460fcdfe8900755725f946c5d722 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_workstation.html 8d90e75af88aa2cbcbfed5345330f35787d10f9700b673c13fd1c0d39841301a 2 @@ -220 +220 @@ -/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-standard.html 0fbe60e9818ef7ed7f27eb363e0d17e3e5a90abf053ead935d9c3c402da8fb8e 2 +/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-standard.html ba4fd74f77a22f72e82604e252ecc3c316d855abb33e758b4cb75ddf3a14c5cc 2 @@ -277,3 +277,3 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds-1.2.xml d37d88ee313ea568addbb45d0516c7b14bbe7d041bb9f76b9db2e32946b3fe55 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds.xml e6a8e646d1c8e4292baf4e0787eddaee40aef476fefeec376152ae481712f4ab 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ocil.xml 5ef47ce9ee39ee1578a73ac59c61545ed7042a287f2d279bbe499fd8a6996f25 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds-1.2.xml 11c9452f9e87cf4a7ef07061e8a3b94db8644ab6b491bccaa9741ee867bdd44f 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds.xml 2d2fb8b5cd135fb369f307ed727712cbc88f8ce345ec93cd337e05e65130ec2a 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ocil.xml 777c77eef01735e7e302bd1f63589f5100c6a54de3ca23efb989780f14cb7bd4 0 @@ -281 +281 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-xccdf.xml 4aaf5af951ce9dee9366bf34d684a400b15ff9946e2a54faff572ca3e41b9e52 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-xccdf.xml 854ee7a2c001a6c0e6227e08eeb54669774140caa6dd7bc62b60048c18246383 0 @@ -284,3 +284,3 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds-1.2.xml c03f5caff07b529703e1b13fdf4d01a2570e38f80305e7697f1a197fd57b0ad5 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds.xml da1e04867a2c616854220fdcb86cd151ca63bd622be6e60a0079e3d769681279 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ocil.xml 9fe5c229dadd3e5d4ac87c58f9a07dee7dd878b12b4163014ffc69cdf33cccdc 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds-1.2.xml 2e75817e91a94e59fd5041d40658ec8305008a4d9a18331dcc819fec7b946c9a 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds.xml c41499e484a5a18c3dccf726270eaf6b64f70511bf78785d424cf0159a50127b 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ocil.xml cc0a47f04e6b81eef66c6a06303d5ee3846f7ed0ee2836fbe10adad165583fb6 0 @@ -288 +288 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-xccdf.xml 4de0b1d6c54817cfae98b0a013d3e545facedd8a06982660a60ca27d7299c1a2 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-xccdf.xml c3fbc37fb218beb9d60d3f66c4e7584012f94d73c96000fc23b2d473334d4c9e 0 @@ -291,3 +291,3 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds-1.2.xml 856022164bf7c059e2192a5bfaababd9feb028644375392eabea1f80a6cc66cc 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml 0b1f5c44472316de970ea6d2d7a68f0534f2d07921ac4793d6f22416c8d04bf6 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ocil.xml 3d7fac4328ed0472f269b59d91358ab26c5b96ba545e5d9965dac704936d397b 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds-1.2.xml 3c8da1b9bee0b50a110d5a3224f77551f4d4675492eaef92ba26488596a583d5 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml cf42bfb7ccca3a5a8190a50010645fda6ec10dced864d24b59a442d4cc4b7f97 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ocil.xml 5e27d7ec2c5954a9b5e095a5d6c4f9f68692e0faac94979adc1aa107d829960f 0 @@ -295 +295 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-xccdf.xml 2663277f60660ee6c229b9bedee11e78dab84e7f510ccc804774250367bade99 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-xccdf.xml b2b6f69096f8cf6f577660f970373c5a4d44402d3474c0d4696196fb7783a1c8 0 @@ -298,3 +298,3 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds-1.2.xml 45f740e64d753c0fb8b6be2e31d9a883e5f07d147c9d7382532aec9262e13f26 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml 3ff81577f361a3e716bdf7ade1d7b4a1b5ff03a04db912af51cca9a2200c6f4b 0 -/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ocil.xml 3a5893b5b04a44852b8a54b3ac54ffda6e9ecae7315c1dc0a24f79cbd6236394 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds-1.2.xml ad17fb4f9cdedaff5c5f833602ec36218696977c4610b70ebe18ce701b0b5294 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml 317bb7cf2b88facecd0facf2bcb470fa3a1bbaaa75dcb2c42710552ee4e3e051 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ocil.xml 6715057c360e9792d595afc9ee30a26555116c77d627b0a447bcbb259aa5cc3a 0 @@ -302 +302 @@ -/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-xccdf.xml 01c787e9ed51e03335166b48e8e6bf2eccf86415560f54904468c58f32cef009 0 +/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-xccdf.xml 55eb961e2aad924b895a45e72be454d47068d0ee5f1e3c969d976043d76e0361 0 comparing rpmtags comparing RELEASE comparing PROVIDES comparing scripts comparing filelist comparing file checksum creating rename script RPM file checksum differs. Extracting packages /usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_average.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_average.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_average.html 2022-10-05 00:00:00.000000000 +0000 @@ -65,7 +65,7 @@ other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic.

Profile Information

Rule   Record attempts to alter time through settimeofday   [ref]

If the auditd daemon is configured to use the @@ -13771,21 +13771,7 @@ nefarious activities in log files, as well as to confuse network services that are highly dependent upon an accurate system time (such as sshd). All changes to the system time should be audited.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_audit_rules_time_settimeofday
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-001487, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, Req-10.4.2.b, 4.1.3


Complexity:low
Disruption:low
Reboot:true
Strategy:restrict
---
-apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    storage:
-      files:
-      - contents:
-          source: data:,{{ -a%20always%2Cexit%20-F%20arch%3Db64%20-S%20settimeofday%20-k%20audit_time_rules%0A-a%20always%2Cexit%20-F%20arch%3Db32%20-S%20settimeofday%20-k%20audit_time_rules%0A }}
-        mode: 0600
-        path: /etc/audit/rules.d/75-syscall-settimeofday.rules
-        overwrite: true
-


# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/tables/table-ol7-anssirefs.html differs (HTML document, UTF-8 Unicode text)
--- old//usr/share/doc/scap-security-guide/tables/table-ol7-anssirefs.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/tables/table-ol7-anssirefs.html	2022-10-05 00:00:00.000000000 +0000
@@ -45,33 +45,31 @@
BP28(R1)Remove tftp DaemonUninstall talk-server Package - Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, -typically used to automatically transfer configuration or boot files between systems. -TFTP does not support authentication and can be easily hacked. The package -tftp is a client program that allows for connections to a tftp server. + The talk-server package can be removed with the following command: 
 $ sudo yum erase talk-server
 - It is recommended that TFTP be removed, unless there is a specific need -for TFTP (such as a boot server). In that case, use extreme caution when configuring -the services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk-server package decreases the +risk of the accidental (or intentional) activation of talk services.
BP28(R1)Uninstall DHCP Server PackageUninstall ypserv Package - If the system does not need to act as a DHCP server, -the dhcp package can be uninstalled. - -The dhcp package can be removed with the following command: + The ypserv package can be removed with the following command: 
-$ sudo yum erase dhcp
+$ sudo yum erase ypserv 		- Removing the DHCP server ensures that it cannot be easily or -accidentally reactivated and disrupt network operation. + The NIS service provides an unencrypted authentication service which does +not provide for the confidentiality and integrity of user passwords or the +remote session. + +Removing the ypserv package decreases the risk of the accidental +(or intentional) activation of NIS or NIS+ services.
BP28(R1)Uninstall rsh PackageRemove telnet Clients - -The rsh package contains the client commands - -for the rsh services + The telnet client allows users to start connections to other systems via +the telnet protocol. - These legacy clients contain numerous security exposures and have -been replaced with the more secure SSH package. Even if the server is removed, -it is best to ensure the clients are also removed to prevent users from -inadvertently attempting to use these commands and therefore exposing - -their credentials. Note that removing the rsh package removes - -the clients for rsh,rcp, and rlogin. + The telnet protocol is insecure and unencrypted. The use +of an unencrypted transmission medium could allow an unauthorized user +to steal credentials. The ssh package provides an +encrypted session and stronger security and is included in Oracle Linux 7.
BP28(R1)Uninstall Sendmail PackageUninstall rsh-server Package - Sendmail is not the default mail transfer agent and is -not installed by default. -The sendmail package can be removed with the following command: + The rsh-server package can be removed with the following command: 
-$ sudo yum erase sendmail
+$ sudo yum erase rsh-server 		- The sendmail software was not developed with security in mind and -its design prevents it from being effectively contained by SELinux. Postfix -should be used instead. + The rsh-server service provides unencrypted remote access service which does not +provide for the confidentiality and integrity of user passwords or the remote session and has very weak +authentication. If a privileged user were to login using this service, the privileged user password +could be compromised. The rsh-server package provides several obsolete and insecure +network services. Removing it decreases the risk of those services' accidental (or intentional) +activation.
BP28(R1)Uninstall ypserv PackageUninstall tftp-server Package - The ypserv package can be removed with the following command: + The tftp-server package can be removed with the following command: 
 $ sudo yum erase tftp-server
+ 		+ Removing the tftp-server package decreases the risk of the accidental +(or intentional) activation of tftp services. +

+If TFTP is required for operational support (such as transmission of router +configurations), its use must be documented with the Information Systems +Securty Manager (ISSM), restricted to only authorized personnel, and have +access control rules established. +
BP28(R1)Uninstall talk Package + The talk package contains the client program for the +Internet talk protocol, which allows the user to chat with other users on +different systems. Talk is a communication program which copies lines from one +terminal to the terminal of another user. +The talk package can be removed with the following command: 
-$ sudo yum erase ypserv
+$ sudo yum erase talk 		- The NIS service provides an unencrypted authentication service which does -not provide for the confidentiality and integrity of user passwords or the -remote session. - -Removing the ypserv package decreases the risk of the accidental -(or intentional) activation of NIS or NIS+ services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk package decreases the +risk of the accidental (or intentional) activation of talk client program.
BP28(R1)Remove telnet Clients - The telnet client allows users to start connections to other systems via -the telnet protocol. - - The telnet protocol is insecure and unencrypted. The use -of an unencrypted transmission medium could allow an unauthorized user -to steal credentials. The ssh package provides an -encrypted session and stronger security and is included in Oracle Linux 7. -
BP28(R1)
NT007(R03)		 Uninstall the telnet server @@ -192,82 +188,86 @@
BP28(R1)Uninstall talk PackageRemove NIS Client - The talk package contains the client program for the -Internet talk protocol, which allows the user to chat with other users on -different systems. Talk is a communication program which copies lines from one -terminal to the terminal of another user. -The talk package can be removed with the following command: -
-$ sudo yum erase talk
+ The Network Information Service (NIS), formerly known as Yellow Pages, +is a client-server directory service protocol used to distribute system configuration +files. The NIS client (ypbind) was used to bind a system to an NIS server +and receive the distributed configuration files. 		- The talk software presents a security risk as it uses unencrypted protocols -for communications. Removing the talk package decreases the -risk of the accidental (or intentional) activation of talk client program. + The NIS service is inherently an insecure system that has been vulnerable +to DOS attacks, buffer overflows and has poor authentication for querying +NIS maps. NIS generally has been replaced by such protocols as Lightweight +Directory Access Protocol (LDAP). It is recommended that the service be +removed.
3.1.1Disable GDM Automatic Login3.1.1
3.4.5		Require Authentication for Single User Mode - The GNOME Display Manager (GDM) can allow users to automatically login without -user interaction or credentials. User should always be required to authenticate themselves -to the system that they are authorized to use. To disable user ability to automatically -login to the system, set the AutomaticLoginEnable to false in the -[daemon] section in /etc/gdm/custom.conf. For example: -
[daemon]
-AutomaticLoginEnable=false
+ Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup. +

+By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. 		- Failure to restrict system access to authenticated users negatively impacts operating -system security. + This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password. +
3.1.1
3.4.5		Require Authentication for Emergency Systemd Target + Emergency mode is intended as a system recovery +method, providing a single user root access to the system +during a failed boot sequence. +

+By default, Emergency mode is protected by requiring a password and is set +in /usr/lib/systemd/system/emergency.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password.
3.1.1
3.1.5		Disable SSH Access via Empty PasswordsDisable SSH Root Login - Disallow SSH login with empty passwords. -The default SSH configuration disables logins with empty passwords. The appropriate -configuration is used if no value is set for PermitEmptyPasswords. -
-To explicitly disallow SSH login from accounts with empty passwords, -add or correct the following line in + The root user should never be allowed to login to a +system directly over a network. +To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config: -
-
PermitEmptyPasswords no
-Any accounts with empty passwords should be disabled immediately, and PAM configuration -should prevent users from being able to assign themselves empty passwords. +
PermitRootLogin no
 - Configuring this setting for the SSH daemon provides additional assurance -that remote login via SSH will require a password, even in the event of -misconfiguration elsewhere. + Even though the communications channel may be encrypted, an additional layer of +security is gained by extending the policy of not logging directly on as root. +In addition, logging in with a user-specific account provides individual +accountability of actions performed on the system and also helps to minimize +direct attack attempts on root's password. +
3.1.1
3.1.5		Restrict Virtual Console Root Logins + To restrict root logins through the (deprecated) virtual console devices, +ensure lines of this form do not appear in /etc/securetty: +
vc/1
+vc/2
+vc/3
+vc/4
+ 		+ Preventing direct root login to virtual console devices +helps ensure accountability for actions taken on the system +using the root account. +
3.1.1
3.1.6		Direct root Logins Not Allowed + To further limit access to the root account, administrators +can disable root logins at the console by editing the /etc/securetty file. +This file lists all devices the root user is allowed to login to. If the file does +not exist at all, the root user can login through any communication device on the +system, whether via the console or via a raw network interface. This is dangerous +as user can login to the system as root via Telnet, which sends the password in +plain text over the network. By default, Oracle Linux 7's +/etc/securetty file only allows the root user to login at the console +physically attached to the system. To prevent root from logging in, remove the +contents of this file. To prevent direct root logins, remove the contents of this +file by typing the following command: +
+$ sudo echo > /etc/securetty
+
+ 		+ Disabling direct root logins ensures proper accountability and multifactor +authentication to privileged accounts. Users will first login, then escalate +to privileged (root) access via su / sudo. This is required for FISMA Low +and FISMA Moderate systems.
3.1.1
3.1.5		Restrict Serial Port Root Logins - To restrict root logins on serial ports, -ensure lines of this form do not appear in /etc/securetty: -
ttyS0
-ttyS1
- 		- Preventing direct root login to serial port interfaces -helps ensure accountability for actions taken on the systems -using the root account. -
3.1.1
3.1.5		 Prevent Login to Accounts With Empty Password If an account is configured for password authentication @@ -160,100 +201,59 @@
3.1.1
3.1.5		Restrict Virtual Console Root LoginsRestrict Serial Port Root Logins - To restrict root logins through the (deprecated) virtual console devices, + To restrict root logins on serial ports, ensure lines of this form do not appear in /etc/securetty: -
vc/1
-vc/2
-vc/3
-vc/4
+
ttyS0
+ttyS1
 - Preventing direct root login to virtual console devices -helps ensure accountability for actions taken on the system + Preventing direct root login to serial port interfaces +helps ensure accountability for actions taken on the systems using the root account.
3.1.1
3.1.6		Direct root Logins Not Allowed - To further limit access to the root account, administrators -can disable root logins at the console by editing the /etc/securetty file. -This file lists all devices the root user is allowed to login to. If the file does -not exist at all, the root user can login through any communication device on the -system, whether via the console or via a raw network interface. This is dangerous -as user can login to the system as root via Telnet, which sends the password in -plain text over the network. By default, Oracle Linux 7's -/etc/securetty file only allows the root user to login at the console -physically attached to the system. To prevent root from logging in, remove the -contents of this file. To prevent direct root logins, remove the contents of this -file by typing the following command: -
-$ sudo echo > /etc/securetty
-
- 		- Disabling direct root logins ensures proper accountability and multifactor -authentication to privileged accounts. Users will first login, then escalate -to privileged (root) access via su / sudo. This is required for FISMA Low -and FISMA Moderate systems. /usr/share/doc/scap-security-guide/tables/table-ol7-nistrefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-ol7-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol7-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -75,56 +75,147 @@
AU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysignEnsure auditd Collects Information on Kernel Module Unloading - delete_module - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+ To capture kernel module unloading events, use following line, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: + +
-a always,exit -F arch=ARCH -S delete_module -F auid>=1000 -F auid!=unset -F key=modules
+ + +Place to add the line depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the line to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the line to file /etc/audit/audit.rules. + 		+ The removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel. +
AU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on Kernel Module Loading and Unloading + To capture kernel module loading and unloading events, use following lines, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: +
+-a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules
+
+ +The place to add the lines depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the lines to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the lines to file /etc/audit/audit.rules. + 		+ The addition/removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel. +
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Ownership Changes to Files - fchown + The audit system should collect unsuccessful file ownership change +attempts for all users and root. +If the auditd daemon is configured +to use the augenrules program to read audit rules during daemon +startup (the default), add the following lines to a file with suffix +.rules in the directory /etc/audit/rules.d. If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+utility to read audit rules during daemon startup, add the following lines to +/etc/audit/audit.rules file. +
-a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+If the system is 64 bit then also add the following lines: +
-a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. + Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing +these events could serve as evidence of potential system compromise. +
IA-2
AC-3
CM-6(a)		Require Authentication for Single User Mode + Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup.

-Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. +By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Access Attempts to Files - creatRecord Events that Modify the System's Discretionary Access Controls - fchown + At a minimum, the audit system should collect file permission +changes for all users and root. If the auditd daemon is configured +to use the augenrules program to read audit rules during daemon +startup (the default), add the following line to a file with suffix +.rules in the directory /etc/audit/rules.d: +
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ +If the system is 64 bit then also add the following line: +
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ +If the auditd daemon is configured to use the auditctl +utility to read audit rules during daemon startup, add the following line to +/etc/audit/audit.rules file: +
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ +If the system is 64 bit then also add the following line: +
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ 		+ The changing of file permissions could indicate that a user is attempting to +gain access to information that would otherwise be disallowed. Auditing DAC modifications +can facilitate the identification of patterns of abuse among both authorized and +unauthorized users. +
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Access Attempts to Files - open At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+ If the system is 64 bit then also add the following lines: 
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access +-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access + If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+ If the system is 64 bit then also add the following lines: 
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access +-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access 		Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing @@ -133,31 +224,33 @@
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Permission Changes to Files - fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fchmod - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. + At a minimum, the audit system should collect file permission +changes for all users and root. If the auditd daemon is configured to +use the augenrules program to read audit rules during daemon startup +(the default), add the following line to a file with suffix .rules in +the directory /etc/audit/rules.d: +
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
+If the system is 64 bit then also add the following line: +
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the auditd daemon is configured to use the auditctl /usr/share/doc/scap-security-guide/tables/table-ol7-ospprefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-ol7-ospprefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol7-ospprefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -45,20 +45,6 @@
AGD_PRE.1
AGD_OPE.1		Install openscap-scanner Package - The openscap-scanner package can be installed with the following command: -
-$ sudo yum install openscap-scanner
- 		- openscap-scanner contains the oscap command line tool. This tool is a -configuration and vulnerability scanner, capable of performing compliance checking using -SCAP content. -
AGD_PRE.1
AGD_OPE.1		 Install scap-security-guide Package The scap-security-guide package can be installed with the following command: @@ -78,16 +64,17 @@
FAU_GEN.1Include Local Events in Audit LogsAGD_PRE.1
AGD_OPE.1		Install openscap-scanner Package - To configure Audit daemon to include local events in Audit logs, set -local_events to yes in /etc/audit/auditd.conf. -This is the default setting. + The openscap-scanner package can be installed with the following command: +
+$ sudo yum install openscap-scanner
 - If option local_events isn't set to yes only events from -network will be aggregated. + openscap-scanner contains the oscap command line tool. This tool is a +configuration and vulnerability scanner, capable of performing compliance checking using +SCAP content.
FAU_GEN.1Disable SSH Root Login + The root user should never be allowed to login to a +system directly over a network. +To disable root login via SSH, add or correct the following line in + + +/etc/ssh/sshd_config: + +
PermitRootLogin no
+ 		+ Even though the communications channel may be encrypted, an additional layer of +security is gained by extending the policy of not logging directly on as root. +In addition, logging in with a user-specific account provides individual +accountability of actions performed on the system and also helps to minimize +direct attack attempts on root's password. +
FAU_GEN.1 Enable auditd Service The auditd service is an essential userspace component of @@ -135,16 +143,15 @@
FAU_GEN.1Set number of records to cause an explicit flush to audit logsInclude Local Events in Audit Logs - To configure Audit daemon to issue an explicit flush to disk command -after writing 50 records, set freq to 50 -in /etc/audit/auditd.conf. + To configure Audit daemon to include local events in Audit logs, set +local_events to yes in /etc/audit/auditd.conf. +This is the default setting. - If option freq isn't set to , the flush to disk -may happen after higher number of records, increasing the danger -of audit loss. + If option local_events isn't set to yes only events from +network will be aggregated.
FAU_GEN.1Disable SSH Root LoginSet number of records to cause an explicit flush to audit logs - The root user should never be allowed to login to a -system directly over a network. -To disable root login via SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -
PermitRootLogin no
+ To configure Audit daemon to issue an explicit flush to disk command +after writing 50 records, set freq to 50 +in /etc/audit/auditd.conf. 		- Even though the communications channel may be encrypted, an additional layer of -security is gained by extending the policy of not logging directly on as root. -In addition, logging in with a user-specific account provides individual -accountability of actions performed on the system and also helps to minimize -direct attack attempts on root's password. + If option freq isn't set to , the flush to disk +may happen after higher number of records, increasing the danger +of audit loss.
FAU_GEN.1.1.cEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
- 		- Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. -

-Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. -
FAU_GEN.1.1.cRecord Unsuccessful Access Attempts to Files - creat - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: -
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: -
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
- 		- Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. -
FAU_GEN.1.1.cRecord Attempts to Alter Process and Session Initiation InformationEnsure auditd Collects Information on Kernel Module Unloading - delete_module - The audit system already collects process information for all -users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual /usr/share/doc/scap-security-guide/tables/table-ol7-pcidssrefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-ol7-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol7-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -78,25 +78,30 @@
Req-6.2Ensure Software Patches InstalledEnsure gpgcheck Enabled In Main yum Configuration - -If the system is joined to the ULN -or a yum server, run the following command to install updates: -
$ sudo yum update
-If the system is not configured to use one of these sources, updates (in the form of RPM packages) -can be manually downloaded from the ULN and installed using rpm. - -

-NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy -dictates. + The gpgcheck option controls whether +RPM packages' signatures are always checked prior to installation. +To configure yum to check package signatures before installing +them, ensure the following line appears in /etc/yum.conf in +the [main] section: +
gpgcheck=1
 - Installing software updates is a fundamental mitigation against -the exploitation of publicly-known vulnerabilities. If the most -recent security patches and updates are not installed, unauthorized -users may take advantage of weaknesses in the unpatched software. The -lack of prompt attention to patching could result in a system compromise. + Changes to any software components can have significant effects on the +overall security of the operating system. This requirement ensures the +software has not been tampered with and that it has been provided by a +trusted vendor. +
+Accordingly, patches, service packs, device drivers, or operating system +components must be signed with a certificate recognized and approved by the +organization. +
Verifying the authenticity of the software prior to installation +validates the integrity of the patch or upgrade received from a vendor. +This ensures the software has not been tampered with and that it has been +provided by a trusted vendor. Self-signed certificates are disallowed by +this requirement. Certificates used to verify the software must be from an +approved Certificate Authority (CA).
Req-6.2Ensure gpgcheck Enabled In Main yum ConfigurationEnsure Software Patches Installed - The gpgcheck option controls whether -RPM packages' signatures are always checked prior to installation. -To configure yum to check package signatures before installing -them, ensure the following line appears in /etc/yum.conf in -the [main] section: -
gpgcheck=1
+ +If the system is joined to the ULN +or a yum server, run the following command to install updates: +
$ sudo yum update
+If the system is not configured to use one of these sources, updates (in the form of RPM packages) +can be manually downloaded from the ULN and installed using rpm. + +

+NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy +dictates. 		- Changes to any software components can have significant effects on the -overall security of the operating system. This requirement ensures the -software has not been tampered with and that it has been provided by a -trusted vendor. -
-Accordingly, patches, service packs, device drivers, or operating system -components must be signed with a certificate recognized and approved by the -organization. -
Verifying the authenticity of the software prior to installation -validates the integrity of the patch or upgrade received from a vendor. -This ensures the software has not been tampered with and that it has been -provided by a trusted vendor. Self-signed certificates are disallowed by -this requirement. Certificates used to verify the software must be from an -approved Certificate Authority (CA). + Installing software updates is a fundamental mitigation against +the exploitation of publicly-known vulnerabilities. If the most +recent security patches and updates are not installed, unauthorized +users may take advantage of weaknesses in the unpatched software. The +lack of prompt attention to patching could result in a system compromise.
Req-7.1Verify the UEFI Boot Loader grub.cfg User OwnershipVerify /boot/grub2/grub.cfg User Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
+To properly set the owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chown root /boot/grub2/grub.cfg
Only root should be able to modify important boot parameters. @@ -172,14 +172,14 @@
Req-7.1Verify /boot/grub2/grub.cfg Group OwnershipVerify the UEFI Boot Loader grub.cfg Group Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chgrp root /boot/grub2/grub.cfg
+To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -188,14 +188,14 @@
Req-7.1Verify the UEFI Boot Loader grub.cfg Group OwnershipVerify /boot/grub2/grub.cfg Group Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
+To properly set the group owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chgrp root /boot/grub2/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -204,14 +204,14 @@
Req-7.1Verify /boot/grub2/grub.cfg User OwnershipVerify the UEFI Boot Loader grub.cfg User Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chown root /boot/grub2/grub.cfg
+To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
Only root should be able to modify important boot parameters. @@ -294,11 +294,41 @@
Req-8.1.8Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle PeriodSet SSH Idle Timeout Interval - If not already configured, ensure that users cannot change GNOME3 screensaver lock settings -by adding 
/org/gnome/desktop/screensaver/lock-enabled
-to /etc/dconf/db/local.d/00-security-settings. + SSH allows administrators to set an idle timeout interval. After this interval +has passed, the idle user will be automatically logged out. +

+To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as +follows: +
ClientAliveInterval 300
+

+The timeout interval is given in seconds. For example, have a timeout +of 10 minutes, set interval to 600. +

+If a shorter timeout has already been set for the login shell, that value will +preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that +some processes may stop SSH from correctly detecting that the user is idle. + 		+ Terminating an idle ssh session within a short time period reduces the window of +opportunity for unauthorized personnel to take control of a management session +enabled on the console or console port that has been let unattended. +
BP28(R1)Remove tftp DaemonUninstall talk-server Package - Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, -typically used to automatically transfer configuration or boot files between systems. -TFTP does not support authentication and can be easily hacked. The package -tftp is a client program that allows for connections to a tftp server. + The talk-server package can be removed with the following command: 
 $ sudo yum erase talk-server
 - It is recommended that TFTP be removed, unless there is a specific need -for TFTP (such as a boot server). In that case, use extreme caution when configuring -the services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk-server package decreases the +risk of the accidental (or intentional) activation of talk services.
BP28(R1)Uninstall DHCP Server PackageUninstall ypserv Package - If the system does not need to act as a DHCP server, -the dhcp package can be uninstalled. - -The dhcp-server package can be removed with the following command: + The ypserv package can be removed with the following command: 
-$ sudo yum erase dhcp-server
+$ sudo yum erase ypserv 		- Removing the DHCP server ensures that it cannot be easily or -accidentally reactivated and disrupt network operation. + The NIS service provides an unencrypted authentication service which does +not provide for the confidentiality and integrity of user passwords or the +remote session. + +Removing the ypserv package decreases the risk of the accidental +(or intentional) activation of NIS or NIS+ services.
BP28(R1)Uninstall rsh PackageRemove telnet Clients - -The rsh package contains the client commands - -for the rsh services + The telnet client allows users to start connections to other systems via +the telnet protocol. - These legacy clients contain numerous security exposures and have -been replaced with the more secure SSH package. Even if the server is removed, -it is best to ensure the clients are also removed to prevent users from -inadvertently attempting to use these commands and therefore exposing - -their credentials. Note that removing the rsh package removes - -the clients for rsh,rcp, and rlogin. + The telnet protocol is insecure and unencrypted. The use +of an unencrypted transmission medium could allow an unauthorized user +to steal credentials. The ssh package provides an +encrypted session and stronger security and is included in Oracle Linux 8.
BP28(R1)Uninstall Sendmail PackageUninstall rsh-server Package - Sendmail is not the default mail transfer agent and is -not installed by default. -The sendmail package can be removed with the following command: + The rsh-server package can be removed with the following command: 
-$ sudo yum erase sendmail
+$ sudo yum erase rsh-server 		- The sendmail software was not developed with security in mind and -its design prevents it from being effectively contained by SELinux. Postfix -should be used instead. + The rsh-server service provides unencrypted remote access service which does not +provide for the confidentiality and integrity of user passwords or the remote session and has very weak +authentication. If a privileged user were to login using this service, the privileged user password +could be compromised. The rsh-server package provides several obsolete and insecure +network services. Removing it decreases the risk of those services' accidental (or intentional) +activation.
BP28(R1)Uninstall ypserv PackageUninstall tftp-server Package - The ypserv package can be removed with the following command: + The tftp-server package can be removed with the following command: 
 $ sudo yum erase tftp-server
+ 		+ Removing the tftp-server package decreases the risk of the accidental +(or intentional) activation of tftp services. +

+If TFTP is required for operational support (such as transmission of router +configurations), its use must be documented with the Information Systems +Securty Manager (ISSM), restricted to only authorized personnel, and have +access control rules established. +
BP28(R1)Uninstall talk Package + The talk package contains the client program for the +Internet talk protocol, which allows the user to chat with other users on +different systems. Talk is a communication program which copies lines from one +terminal to the terminal of another user. +The talk package can be removed with the following command: 
-$ sudo yum erase ypserv
+$ sudo yum erase talk 		- The NIS service provides an unencrypted authentication service which does -not provide for the confidentiality and integrity of user passwords or the -remote session. - -Removing the ypserv package decreases the risk of the accidental -(or intentional) activation of NIS or NIS+ services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk package decreases the +risk of the accidental (or intentional) activation of talk client program.
BP28(R1)Remove telnet Clients - The telnet client allows users to start connections to other systems via -the telnet protocol. - - The telnet protocol is insecure and unencrypted. The use -of an unencrypted transmission medium could allow an unauthorized user -to steal credentials. The ssh package provides an -encrypted session and stronger security and is included in Oracle Linux 8. -
BP28(R1)
NT007(R03)		 Uninstall the telnet server @@ -192,82 +188,86 @@
BP28(R1)Uninstall talk PackageRemove NIS Client - The talk package contains the client program for the -Internet talk protocol, which allows the user to chat with other users on -different systems. Talk is a communication program which copies lines from one -terminal to the terminal of another user. -The talk package can be removed with the following command: -
-$ sudo yum erase talk
+ The Network Information Service (NIS), formerly known as Yellow Pages, +is a client-server directory service protocol used to distribute system configuration +files. The NIS client (ypbind) was used to bind a system to an NIS server +and receive the distributed configuration files. 		- The talk software presents a security risk as it uses unencrypted protocols -for communications. Removing the talk package decreases the -risk of the accidental (or intentional) activation of talk client program. + The NIS service is inherently an insecure system that has been vulnerable +to DOS attacks, buffer overflows and has poor authentication for querying +NIS maps. NIS generally has been replaced by such protocols as Lightweight +Directory Access Protocol (LDAP). It is recommended that the service be +removed.
3.1.1Disable GDM Automatic Login3.1.1
3.4.5		Require Authentication for Single User Mode - The GNOME Display Manager (GDM) can allow users to automatically login without -user interaction or credentials. User should always be required to authenticate themselves -to the system that they are authorized to use. To disable user ability to automatically -login to the system, set the AutomaticLoginEnable to false in the -[daemon] section in /etc/gdm/custom.conf. For example: -
[daemon]
-AutomaticLoginEnable=false
+ Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup. +

+By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. 		- Failure to restrict system access to authenticated users negatively impacts operating -system security. + This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password. +
3.1.1
3.4.5		Require Authentication for Emergency Systemd Target + Emergency mode is intended as a system recovery +method, providing a single user root access to the system +during a failed boot sequence. +

+By default, Emergency mode is protected by requiring a password and is set +in /usr/lib/systemd/system/emergency.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password.
3.1.1
3.1.5		Disable SSH Access via Empty PasswordsDisable SSH Root Login - Disallow SSH login with empty passwords. -The default SSH configuration disables logins with empty passwords. The appropriate -configuration is used if no value is set for PermitEmptyPasswords. -
-To explicitly disallow SSH login from accounts with empty passwords, -add or correct the following line in + The root user should never be allowed to login to a +system directly over a network. +To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config: -
-
PermitEmptyPasswords no
-Any accounts with empty passwords should be disabled immediately, and PAM configuration -should prevent users from being able to assign themselves empty passwords. +
PermitRootLogin no
 - Configuring this setting for the SSH daemon provides additional assurance -that remote login via SSH will require a password, even in the event of -misconfiguration elsewhere. + Even though the communications channel may be encrypted, an additional layer of +security is gained by extending the policy of not logging directly on as root. +In addition, logging in with a user-specific account provides individual +accountability of actions performed on the system and also helps to minimize +direct attack attempts on root's password. +
3.1.1
3.1.5		Restrict Virtual Console Root Logins + To restrict root logins through the (deprecated) virtual console devices, +ensure lines of this form do not appear in /etc/securetty: +
vc/1
+vc/2
+vc/3
+vc/4
+ 		+ Preventing direct root login to virtual console devices +helps ensure accountability for actions taken on the system +using the root account. +
3.1.1
3.1.6		Direct root Logins Not Allowed + To further limit access to the root account, administrators +can disable root logins at the console by editing the /etc/securetty file. +This file lists all devices the root user is allowed to login to. If the file does +not exist at all, the root user can login through any communication device on the +system, whether via the console or via a raw network interface. This is dangerous +as user can login to the system as root via Telnet, which sends the password in +plain text over the network. By default, Oracle Linux 8's +/etc/securetty file only allows the root user to login at the console +physically attached to the system. To prevent root from logging in, remove the +contents of this file. To prevent direct root logins, remove the contents of this +file by typing the following command: +
+$ sudo echo > /etc/securetty
+
+ 		+ Disabling direct root logins ensures proper accountability and multifactor +authentication to privileged accounts. Users will first login, then escalate +to privileged (root) access via su / sudo. This is required for FISMA Low +and FISMA Moderate systems.
3.1.1
3.1.5		Restrict Serial Port Root Logins - To restrict root logins on serial ports, -ensure lines of this form do not appear in /etc/securetty: -
ttyS0
-ttyS1
- 		- Preventing direct root login to serial port interfaces -helps ensure accountability for actions taken on the systems -using the root account. -
3.1.1
3.1.5		 Prevent Login to Accounts With Empty Password If an account is configured for password authentication @@ -160,100 +201,59 @@
3.1.1
3.1.5		Restrict Virtual Console Root LoginsRestrict Serial Port Root Logins - To restrict root logins through the (deprecated) virtual console devices, + To restrict root logins on serial ports, ensure lines of this form do not appear in /etc/securetty: -
vc/1
-vc/2
-vc/3
-vc/4
+
ttyS0
+ttyS1
 - Preventing direct root login to virtual console devices -helps ensure accountability for actions taken on the system + Preventing direct root login to serial port interfaces +helps ensure accountability for actions taken on the systems using the root account.
3.1.1
3.1.6		Direct root Logins Not Allowed - To further limit access to the root account, administrators -can disable root logins at the console by editing the /etc/securetty file. -This file lists all devices the root user is allowed to login to. If the file does -not exist at all, the root user can login through any communication device on the -system, whether via the console or via a raw network interface. This is dangerous -as user can login to the system as root via Telnet, which sends the password in -plain text over the network. By default, Oracle Linux 8's -/etc/securetty file only allows the root user to login at the console -physically attached to the system. To prevent root from logging in, remove the -contents of this file. To prevent direct root logins, remove the contents of this -file by typing the following command: -
-$ sudo echo > /etc/securetty
-
- 		- Disabling direct root logins ensures proper accountability and multifactor -authentication to privileged accounts. Users will first login, then escalate -to privileged (root) access via su / sudo. This is required for FISMA Low -and FISMA Moderate systems. /usr/share/doc/scap-security-guide/tables/table-ol8-nistrefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-ol8-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol8-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -74,68 +74,106 @@
AU-2(a)Configure immutable Audit login UIDs + Configure kernel to prevent modification of login UIDs once they are set. +Changing login UIDs while this configuration is enforced requires special capabilities which +are not available to unprivileged users. + +The following rules configure audit as described above: +
## Make the loginuid immutable. This prevents tampering with the auid.
+--loginuid-immutable
+ +Load new Audit rules into kernel by running: +
augenrules --load
+ 		+ If modification of login UIDs is not prevented, they can be changed by unprivileged users and +make auditing complicated or impossible. +
AU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysignEnsure auditd Collects Information on Kernel Module Unloading - delete_module - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+ To capture kernel module unloading events, use following line, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: + +
-a always,exit -F arch=ARCH -S delete_module -F auid>=1000 -F auid!=unset -F key=modules
+ + +Place to add the line depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the line to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the line to file /etc/audit/audit.rules. 		- Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. -

-Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. + The removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Access Attempts to Files - creatAU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on Kernel Module Loading and Unloading - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: -
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: + To capture kernel module loading and unloading events, use following lines, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: 
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules + + +The place to add the lines depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the lines to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the lines to file /etc/audit/audit.rules. 		- Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. + The addition/removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel. +
AU-2(a)Configure auditing of unsuccessful file creations + Ensure that unsuccessful attempts to create a file are audited. + +The following rules configure audit as described above: +
## Unsuccessful file creation (open with O_CREAT)
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+ +Load new Audit rules into kernel by running: +
augenrules --load
+ +Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. + 		+ Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Permission Changes to Files - fsetxattrRecord Unsuccessful Ownership Changes to Files - fchown - The audit system should collect unsuccessful file permission change + The audit system should collect unsuccessful file ownership change attempts for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon @@ -144,40 +182,125 @@ If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file. -
-a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
--a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+
-a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines: -
-a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
--a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+
-a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing + Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(a)Configure auditing of successful permission changesIA-2
AC-3
CM-6(a)		Require Authentication for Single User Mode - Ensure that successful attempts to modify permissions of files or directories are audited. + Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup. +

+By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password. +
AU-2(d)
AU-12(c)
CM-6(a)		Record Events that Modify the System's Discretionary Access Controls - fchown + At a minimum, the audit system should collect file permission /usr/share/doc/scap-security-guide/tables/table-ol8-pcidssrefs.html differs (HTML document, ASCII text) --- old//usr/share/doc/scap-security-guide/tables/table-ol8-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-ol8-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -78,25 +78,30 @@
Req-6.2Ensure Software Patches InstalledEnsure gpgcheck Enabled In Main yum Configuration - -If the system is joined to the ULN -or a yum server, run the following command to install updates: -
$ sudo yum update
-If the system is not configured to use one of these sources, updates (in the form of RPM packages) -can be manually downloaded from the ULN and installed using rpm. - -

-NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy -dictates. + The gpgcheck option controls whether +RPM packages' signatures are always checked prior to installation. +To configure yum to check package signatures before installing +them, ensure the following line appears in /etc/yum.conf in +the [main] section: +
gpgcheck=1
 - Installing software updates is a fundamental mitigation against -the exploitation of publicly-known vulnerabilities. If the most -recent security patches and updates are not installed, unauthorized -users may take advantage of weaknesses in the unpatched software. The -lack of prompt attention to patching could result in a system compromise. + Changes to any software components can have significant effects on the +overall security of the operating system. This requirement ensures the +software has not been tampered with and that it has been provided by a +trusted vendor. +
+Accordingly, patches, service packs, device drivers, or operating system +components must be signed with a certificate recognized and approved by the +organization. +
Verifying the authenticity of the software prior to installation +validates the integrity of the patch or upgrade received from a vendor. +This ensures the software has not been tampered with and that it has been +provided by a trusted vendor. Self-signed certificates are disallowed by +this requirement. Certificates used to verify the software must be from an +approved Certificate Authority (CA).
Req-6.2Ensure gpgcheck Enabled In Main yum ConfigurationEnsure Software Patches Installed - The gpgcheck option controls whether -RPM packages' signatures are always checked prior to installation. -To configure yum to check package signatures before installing -them, ensure the following line appears in /etc/yum.conf in -the [main] section: -
gpgcheck=1
+ +If the system is joined to the ULN +or a yum server, run the following command to install updates: +
$ sudo yum update
+If the system is not configured to use one of these sources, updates (in the form of RPM packages) +can be manually downloaded from the ULN and installed using rpm. + +

+NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy +dictates. 		- Changes to any software components can have significant effects on the -overall security of the operating system. This requirement ensures the -software has not been tampered with and that it has been provided by a -trusted vendor. -
-Accordingly, patches, service packs, device drivers, or operating system -components must be signed with a certificate recognized and approved by the -organization. -
Verifying the authenticity of the software prior to installation -validates the integrity of the patch or upgrade received from a vendor. -This ensures the software has not been tampered with and that it has been -provided by a trusted vendor. Self-signed certificates are disallowed by -this requirement. Certificates used to verify the software must be from an -approved Certificate Authority (CA). + Installing software updates is a fundamental mitigation against +the exploitation of publicly-known vulnerabilities. If the most +recent security patches and updates are not installed, unauthorized +users may take advantage of weaknesses in the unpatched software. The +lack of prompt attention to patching could result in a system compromise.
Req-7.1Verify the UEFI Boot Loader grub.cfg User OwnershipVerify /boot/grub2/grub.cfg User Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
+To properly set the owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chown root /boot/grub2/grub.cfg
Only root should be able to modify important boot parameters. @@ -172,14 +172,14 @@
Req-7.1Verify /boot/grub2/grub.cfg Group OwnershipVerify the UEFI Boot Loader grub.cfg Group Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chgrp root /boot/grub2/grub.cfg
+To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -188,14 +188,14 @@
Req-7.1Verify the UEFI Boot Loader grub.cfg Group OwnershipVerify /boot/grub2/grub.cfg Group Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
+To properly set the group owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chgrp root /boot/grub2/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -204,14 +204,14 @@
Req-7.1Verify /boot/grub2/grub.cfg User OwnershipVerify the UEFI Boot Loader grub.cfg User Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chown root /boot/grub2/grub.cfg
+To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
Only root should be able to modify important boot parameters. @@ -294,11 +294,41 @@
Req-8.1.8Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle PeriodSet SSH Idle Timeout Interval - If not already configured, ensure that users cannot change GNOME3 screensaver lock settings -by adding 
/org/gnome/desktop/screensaver/lock-enabled
-to /etc/dconf/db/local.d/00-security-settings. + SSH allows administrators to set an idle timeout interval. After this interval +has passed, the idle user will be automatically logged out. +

+To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as +follows: +
ClientAliveInterval 300
+

+The timeout interval is given in seconds. For example, have a timeout +of 10 minutes, set interval to 600. +

+If a shorter timeout has already been set for the login shell, that value will +preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that +some processes may stop SSH from correctly detecting that the user is idle. + 		+ Terminating an idle ssh session within a short time period reduces the window of +opportunity for unauthorized personnel to take control of a management session +enabled on the console or console port that has been let unattended. +
AU-2(a)Configure immutable Audit login UIDs + Configure kernel to prevent modification of login UIDs once they are set. +Changing login UIDs while this configuration is enforced requires special capabilities which +are not available to unprivileged users. + +The following rules configure audit as described above: +
## Make the loginuid immutable. This prevents tampering with the auid.
+--loginuid-immutable
+ +Load new Audit rules into kernel by running: +
augenrules --load
+ 		+ If modification of login UIDs is not prevented, they can be changed by unprivileged users and +make auditing complicated or impossible. +
AU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysignEnsure auditd Collects Information on Kernel Module Unloading - delete_module - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=unset -F key=privileged
+ To capture kernel module unloading events, use following line, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: + +
-a always,exit -F arch=ARCH -S delete_module -F key=modules
+ + +Place to add the line depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the line to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the line to file /etc/audit/audit.rules. 		- Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. -

-Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. + The removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Access Attempts to Files - creatAU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on Kernel Module Loading and Unloading - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: -
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: + To capture kernel module loading and unloading events, use following lines, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: 
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules + + +The place to add the lines depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the lines to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the lines to file /etc/audit/audit.rules. 		- Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. + The addition/removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel. +
AU-2(a)Configure auditing of unsuccessful file creations + Ensure that unsuccessful attempts to create a file are audited. + +The following rules configure audit as described above: +
## Unsuccessful file creation (open with O_CREAT)
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+ +Load new Audit rules into kernel by running: +
augenrules --load
+ +Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. + 		+ Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Permission Changes to Files - fsetxattrRecord Unsuccessful Ownership Changes to Files - fchown - The audit system should collect unsuccessful file permission change + The audit system should collect unsuccessful file ownership change attempts for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon @@ -144,40 +182,125 @@ If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file. -
-a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
--a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+
-a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines: -
-a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
--a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+
-a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing + Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(a)Configure auditing of successful permission changesIA-2
AC-3
CM-6(a)		Require Authentication for Single User Mode - Ensure that successful attempts to modify permissions of files or directories are audited. + Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup. +

+By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password. +
AU-2(d)
AU-12(c)
CM-6(a)		Record Events that Modify the System's Discretionary Access Controls - fchown + At a minimum, the audit system should collect file permission /usr/share/doc/scap-security-guide/tables/table-rhel7-anssirefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel7-anssirefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel7-anssirefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -45,33 +45,31 @@
BP28(R1)Remove tftp DaemonUninstall talk-server Package - Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, -typically used to automatically transfer configuration or boot files between systems. -TFTP does not support authentication and can be easily hacked. The package -tftp is a client program that allows for connections to a tftp server. + The talk-server package can be removed with the following command: 
 $ sudo yum erase talk-server
 - It is recommended that TFTP be removed, unless there is a specific need -for TFTP (such as a boot server). In that case, use extreme caution when configuring -the services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk-server package decreases the +risk of the accidental (or intentional) activation of talk services.
BP28(R1)Uninstall DHCP Server PackageUninstall ypserv Package - If the system does not need to act as a DHCP server, -the dhcp package can be uninstalled. - -The dhcp package can be removed with the following command: + The ypserv package can be removed with the following command: 
-$ sudo yum erase dhcp
+$ sudo yum erase ypserv 		- Removing the DHCP server ensures that it cannot be easily or -accidentally reactivated and disrupt network operation. + The NIS service provides an unencrypted authentication service which does +not provide for the confidentiality and integrity of user passwords or the +remote session. + +Removing the ypserv package decreases the risk of the accidental +(or intentional) activation of NIS or NIS+ services.
BP28(R1)Uninstall rsh PackageRemove telnet Clients - -The rsh package contains the client commands - -for the rsh services + The telnet client allows users to start connections to other systems via +the telnet protocol. - These legacy clients contain numerous security exposures and have -been replaced with the more secure SSH package. Even if the server is removed, -it is best to ensure the clients are also removed to prevent users from -inadvertently attempting to use these commands and therefore exposing - -their credentials. Note that removing the rsh package removes - -the clients for rsh,rcp, and rlogin. + The telnet protocol is insecure and unencrypted. The use +of an unencrypted transmission medium could allow an unauthorized user +to steal credentials. The ssh package provides an +encrypted session and stronger security and is included in Red Hat Enterprise Linux 7.
BP28(R1)Uninstall Sendmail PackageUninstall rsh-server Package - Sendmail is not the default mail transfer agent and is -not installed by default. -The sendmail package can be removed with the following command: + The rsh-server package can be removed with the following command: 
-$ sudo yum erase sendmail
+$ sudo yum erase rsh-server 		- The sendmail software was not developed with security in mind and -its design prevents it from being effectively contained by SELinux. Postfix -should be used instead. + The rsh-server service provides unencrypted remote access service which does not +provide for the confidentiality and integrity of user passwords or the remote session and has very weak +authentication. If a privileged user were to login using this service, the privileged user password +could be compromised. The rsh-server package provides several obsolete and insecure +network services. Removing it decreases the risk of those services' accidental (or intentional) +activation.
BP28(R1)Uninstall ypserv PackageUninstall tftp-server Package - The ypserv package can be removed with the following command: + The tftp-server package can be removed with the following command: 
 $ sudo yum erase tftp-server
+ 		+ Removing the tftp-server package decreases the risk of the accidental +(or intentional) activation of tftp services. +

+If TFTP is required for operational support (such as transmission of router +configurations), its use must be documented with the Information Systems +Securty Manager (ISSM), restricted to only authorized personnel, and have +access control rules established. +
BP28(R1)Uninstall talk Package + The talk package contains the client program for the +Internet talk protocol, which allows the user to chat with other users on +different systems. Talk is a communication program which copies lines from one +terminal to the terminal of another user. +The talk package can be removed with the following command: 
-$ sudo yum erase ypserv
+$ sudo yum erase talk 		- The NIS service provides an unencrypted authentication service which does -not provide for the confidentiality and integrity of user passwords or the -remote session. - -Removing the ypserv package decreases the risk of the accidental -(or intentional) activation of NIS or NIS+ services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk package decreases the +risk of the accidental (or intentional) activation of talk client program.
BP28(R1)Remove telnet Clients - The telnet client allows users to start connections to other systems via -the telnet protocol. - - The telnet protocol is insecure and unencrypted. The use -of an unencrypted transmission medium could allow an unauthorized user -to steal credentials. The ssh package provides an -encrypted session and stronger security and is included in Red Hat Enterprise Linux 7. -
BP28(R1)
NT007(R03)		 Uninstall the telnet server @@ -192,82 +188,86 @@
BP28(R1)Uninstall talk PackageRemove NIS Client - The talk package contains the client program for the -Internet talk protocol, which allows the user to chat with other users on -different systems. Talk is a communication program which copies lines from one -terminal to the terminal of another user. -The talk package can be removed with the following command: -
-$ sudo yum erase talk
+ The Network Information Service (NIS), formerly known as Yellow Pages, +is a client-server directory service protocol used to distribute system configuration +files. The NIS client (ypbind) was used to bind a system to an NIS server +and receive the distributed configuration files. 		- The talk software presents a security risk as it uses unencrypted protocols -for communications. Removing the talk package decreases the -risk of the accidental (or intentional) activation of talk client program. + The NIS service is inherently an insecure system that has been vulnerable +to DOS attacks, buffer overflows and has poor authentication for querying +NIS maps. NIS generally has been replaced by such protocols as Lightweight +Directory Access Protocol (LDAP). It is recommended that the service be +removed.
1.1.1.2Disable Mounting of squashfs - -To configure the system to prevent the squashfs -kernel module from being loaded, add the following line to the file /etc/modprobe.d/squashfs.conf: -
install squashfs /bin/true
- -To configure the system to prevent the squashfs from being used, -add the following line to file /etc/modprobe.d/squashfs.conf: -
blacklist squashfs
- -This effectively prevents usage of this uncommon filesystem. - -The squashfs filesystem type is a compressed read-only Linux -filesystem embedded in small footprint systems (similar to -cramfs). A squashfs image can be used without having -to first decompress the image. - 		- Removing support for unneeded filesystem types reduces the local attack -surface of the system. -
1.1.1.2 Disable Mounting of freevxfs @@ -114,23 +89,28 @@
1.1.1.3Disable Mounting of jffs21.1.1.2Disable Mounting of squashfs -To configure the system to prevent the jffs2 -kernel module from being loaded, add the following line to the file /etc/modprobe.d/jffs2.conf: -
install jffs2 /bin/true
+To configure the system to prevent the squashfs +kernel module from being loaded, add the following line to the file /etc/modprobe.d/squashfs.conf: +
install squashfs /bin/true
-To configure the system to prevent the jffs2 from being used, -add the following line to file /etc/modprobe.d/jffs2.conf: -
blacklist jffs2
+To configure the system to prevent the squashfs from being used, +add the following line to file /etc/modprobe.d/squashfs.conf: +
blacklist squashfs
This effectively prevents usage of this uncommon filesystem. + +The squashfs filesystem type is a compressed read-only Linux +filesystem embedded in small footprint systems (similar to +cramfs). A squashfs image can be used without having +to first decompress the image. 		- Linux kernel modules which implement filesystems that are not needed by the -local system should be disabled. + Removing support for unneeded filesystem types reduces the local attack +surface of the system.
1.1.1.3Disable Mounting of jffs2 + +To configure the system to prevent the jffs2 +kernel module from being loaded, add the following line to the file /etc/modprobe.d/jffs2.conf: +
install jffs2 /bin/true
+ +To configure the system to prevent the jffs2 from being used, +add the following line to file /etc/modprobe.d/jffs2.conf: +
blacklist jffs2
+ +This effectively prevents usage of this uncommon filesystem. + 		+ Linux kernel modules which implement filesystems that are not needed by the +local system should be disabled. +
1.1.1.4 Disable Mounting of hfs @@ -757,7 +757,7 @@
1.4.1Set Boot Loader Password in grub2Set the UEFI Boot Loader Password The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. @@ -779,7 +779,7 @@
1.4.1Set the UEFI Boot Loader PasswordSet Boot Loader Password in grub2 The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. @@ -801,14 +801,14 @@
1.4.2Verify the UEFI Boot Loader grub.cfg User OwnershipVerify /boot/grub2/grub.cfg User Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
+To properly set the owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chown root /boot/grub2/grub.cfg
Only root should be able to modify important boot parameters. @@ -816,42 +816,42 @@
1.4.2Verify /boot/grub2/grub.cfg Group OwnershipVerify /boot/grub2/grub.cfg Permissions - The file /boot/grub2/grub.cfg should -be group-owned by the root group to prevent -destruction or modification of the file. + File permissions for /boot/grub2/grub.cfg should be set to 600. -To properly set the group owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chgrp root /boot/grub2/grub.cfg
+To properly set the permissions of /boot/grub2/grub.cfg, run the command: +
$ sudo chmod 600 /boot/grub2/grub.cfg
 - The root group is a highly-privileged group. Furthermore, the group-owner of this -file should not have any access privileges anyway. + Proper permissions ensure that only the root user can modify important boot +parameters.
1.4.2Verify the UEFI Boot Loader grub.cfg PermissionsVerify the UEFI Boot Loader grub.cfg Group Ownership - File permissions for /boot/efi/EFI/redhat/grub.cfg should be set to 700. + The file /boot/efi/EFI/redhat/grub.cfg should +be group-owned by the root group to prevent +destruction or modification of the file. -To properly set the permissions of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chmod 700 /boot/efi/EFI/redhat/grub.cfg
+To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
 - Proper permissions ensure that only the root user can modify important boot -parameters. + The root group is a highly-privileged group. Furthermore, the group-owner of this +file should not have any access privileges anyway.
1.4.2Verify /boot/grub2/grub.cfg PermissionsVerify the UEFI Boot Loader grub.cfg Permissions - File permissions for /boot/grub2/grub.cfg should be set to 600. + File permissions for /boot/efi/EFI/redhat/grub.cfg should be set to 700. -To properly set the permissions of /boot/grub2/grub.cfg, run the command: -
$ sudo chmod 600 /boot/grub2/grub.cfg
+To properly set the permissions of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chmod 700 /boot/efi/EFI/redhat/grub.cfg
 Proper permissions ensure that only the root user can modify important boot @@ -860,14 +860,14 @@
3.1.1Disable GDM Automatic Login3.1.1
3.4.5		Require Authentication for Single User Mode - The GNOME Display Manager (GDM) can allow users to automatically login without -user interaction or credentials. User should always be required to authenticate themselves -to the system that they are authorized to use. To disable user ability to automatically -login to the system, set the AutomaticLoginEnable to false in the -[daemon] section in /etc/gdm/custom.conf. For example: -
[daemon]
-AutomaticLoginEnable=false
+ Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup. +

+By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. 		- Failure to restrict system access to authenticated users negatively impacts operating -system security. + This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password. +
3.1.1
3.4.5		Require Authentication for Emergency Systemd Target + Emergency mode is intended as a system recovery +method, providing a single user root access to the system +during a failed boot sequence. +

+By default, Emergency mode is protected by requiring a password and is set +in /usr/lib/systemd/system/emergency.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password.
3.1.1
3.1.5		Disable SSH Access via Empty PasswordsDisable SSH Root Login - Disallow SSH login with empty passwords. -The default SSH configuration disables logins with empty passwords. The appropriate -configuration is used if no value is set for PermitEmptyPasswords. -
-To explicitly disallow SSH login from accounts with empty passwords, -add or correct the following line in + The root user should never be allowed to login to a +system directly over a network. +To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config: -
-
PermitEmptyPasswords no
-Any accounts with empty passwords should be disabled immediately, and PAM configuration -should prevent users from being able to assign themselves empty passwords. +
PermitRootLogin no
 - Configuring this setting for the SSH daemon provides additional assurance -that remote login via SSH will require a password, even in the event of -misconfiguration elsewhere. + Even though the communications channel may be encrypted, an additional layer of +security is gained by extending the policy of not logging directly on as root. +In addition, logging in with a user-specific account provides individual +accountability of actions performed on the system and also helps to minimize +direct attack attempts on root's password. +
3.1.1
3.1.5		Restrict Virtual Console Root Logins + To restrict root logins through the (deprecated) virtual console devices, +ensure lines of this form do not appear in /etc/securetty: +
vc/1
+vc/2
+vc/3
+vc/4
+ 		+ Preventing direct root login to virtual console devices +helps ensure accountability for actions taken on the system +using the root account. +
3.1.1
3.1.6		Direct root Logins Not Allowed + To further limit access to the root account, administrators +can disable root logins at the console by editing the /etc/securetty file. +This file lists all devices the root user is allowed to login to. If the file does +not exist at all, the root user can login through any communication device on the +system, whether via the console or via a raw network interface. This is dangerous +as user can login to the system as root via Telnet, which sends the password in +plain text over the network. By default, Red Hat Enterprise Linux 7's +/etc/securetty file only allows the root user to login at the console +physically attached to the system. To prevent root from logging in, remove the +contents of this file. To prevent direct root logins, remove the contents of this +file by typing the following command: +
+$ sudo echo > /etc/securetty
+
+ 		+ Disabling direct root logins ensures proper accountability and multifactor +authentication to privileged accounts. Users will first login, then escalate +to privileged (root) access via su / sudo. This is required for FISMA Low +and FISMA Moderate systems.
3.1.1
3.1.5		Restrict Serial Port Root Logins - To restrict root logins on serial ports, -ensure lines of this form do not appear in /etc/securetty: -
ttyS0
-ttyS1
- 		- Preventing direct root login to serial port interfaces -helps ensure accountability for actions taken on the systems -using the root account. -
3.1.1
3.1.5		 Prevent Login to Accounts With Empty Password If an account is configured for password authentication @@ -160,100 +201,59 @@
3.1.1
3.1.5		Restrict Virtual Console Root LoginsRestrict Serial Port Root Logins - To restrict root logins through the (deprecated) virtual console devices, + To restrict root logins on serial ports, ensure lines of this form do not appear in /etc/securetty: -
vc/1
-vc/2
-vc/3
-vc/4
+
ttyS0
+ttyS1
 - Preventing direct root login to virtual console devices -helps ensure accountability for actions taken on the system + Preventing direct root login to serial port interfaces +helps ensure accountability for actions taken on the systems using the root account.
3.1.1
3.1.6		Direct root Logins Not Allowed - To further limit access to the root account, administrators -can disable root logins at the console by editing the /etc/securetty file. -This file lists all devices the root user is allowed to login to. If the file does -not exist at all, the root user can login through any communication device on the -system, whether via the console or via a raw network interface. This is dangerous -as user can login to the system as root via Telnet, which sends the password in -plain text over the network. By default, Red Hat Enterprise Linux 7's -/etc/securetty file only allows the root user to login at the console -physically attached to the system. To prevent root from logging in, remove the -contents of this file. To prevent direct root logins, remove the contents of this -file by typing the following command: -
-$ sudo echo > /etc/securetty
-
- 		- Disabling direct root logins ensures proper accountability and multifactor -authentication to privileged accounts. Users will first login, then escalate -to privileged (root) access via su / sudo. This is required for FISMA Low -and FISMA Moderate systems. /usr/share/doc/scap-security-guide/tables/table-rhel7-nistrefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel7-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel7-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -75,56 +75,147 @@
AU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysignEnsure auditd Collects Information on Kernel Module Unloading - delete_module - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+ To capture kernel module unloading events, use following line, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: + +
-a always,exit -F arch=ARCH -S delete_module -F auid>=1000 -F auid!=unset -F key=modules
+ + +Place to add the line depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the line to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the line to file /etc/audit/audit.rules. + 		+ The removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel. +
AU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on Kernel Module Loading and Unloading + To capture kernel module loading and unloading events, use following lines, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: +
+-a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules
+
+ +The place to add the lines depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the lines to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the lines to file /etc/audit/audit.rules. + 		+ The addition/removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel. +
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Ownership Changes to Files - fchown + The audit system should collect unsuccessful file ownership change +attempts for all users and root. +If the auditd daemon is configured +to use the augenrules program to read audit rules during daemon +startup (the default), add the following lines to a file with suffix +.rules in the directory /etc/audit/rules.d. If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+utility to read audit rules during daemon startup, add the following lines to +/etc/audit/audit.rules file. +
-a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+If the system is 64 bit then also add the following lines: +
-a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
 - Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. + Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing +these events could serve as evidence of potential system compromise. +
IA-2
AC-3
CM-6(a)		Require Authentication for Single User Mode + Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup.

-Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. +By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Access Attempts to Files - creatRecord Events that Modify the System's Discretionary Access Controls - fchown + At a minimum, the audit system should collect file permission +changes for all users and root. If the auditd daemon is configured +to use the augenrules program to read audit rules during daemon +startup (the default), add the following line to a file with suffix +.rules in the directory /etc/audit/rules.d: +
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ +If the system is 64 bit then also add the following line: +
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ +If the auditd daemon is configured to use the auditctl +utility to read audit rules during daemon startup, add the following line to +/etc/audit/audit.rules file: +
-a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ +If the system is 64 bit then also add the following line: +
-a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=unset -F key=perm_mod
+ 		+ The changing of file permissions could indicate that a user is attempting to +gain access to information that would otherwise be disallowed. Auditing DAC modifications +can facilitate the identification of patterns of abuse among both authorized and +unauthorized users. +
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Access Attempts to Files - open At a minimum, the audit system should collect unauthorized file accesses for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon startup (the default), add the following lines to a file with suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+ If the system is 64 bit then also add the following lines: 
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access +-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access + If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+ If the system is 64 bit then also add the following lines: 
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access +-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access 		Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing @@ -133,31 +224,33 @@
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Permission Changes to Files - fsetxattrRecord Events that Modify the System's Discretionary Access Controls - fchmod - The audit system should collect unsuccessful file permission change -attempts for all users and root. -If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d. + At a minimum, the audit system should collect file permission +changes for all users and root. If the auditd daemon is configured to +use the augenrules program to read audit rules during daemon startup +(the default), add the following line to a file with suffix .rules in +the directory /etc/audit/rules.d: +
-a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
+If the system is 64 bit then also add the following line: +
-a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=unset -F key=perm_mod
If the auditd daemon is configured to use the auditctl /usr/share/doc/scap-security-guide/tables/table-rhel7-ospprefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel7-ospprefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel7-ospprefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -45,20 +45,6 @@
AGD_PRE.1
AGD_OPE.1		Install openscap-scanner Package - The openscap-scanner package can be installed with the following command: -
-$ sudo yum install openscap-scanner
- 		- openscap-scanner contains the oscap command line tool. This tool is a -configuration and vulnerability scanner, capable of performing compliance checking using -SCAP content. -
AGD_PRE.1
AGD_OPE.1		 Install scap-security-guide Package The scap-security-guide package can be installed with the following command: @@ -78,16 +64,17 @@
FAU_GEN.1Include Local Events in Audit LogsAGD_PRE.1
AGD_OPE.1		Install openscap-scanner Package - To configure Audit daemon to include local events in Audit logs, set -local_events to yes in /etc/audit/auditd.conf. -This is the default setting. + The openscap-scanner package can be installed with the following command: +
+$ sudo yum install openscap-scanner
 - If option local_events isn't set to yes only events from -network will be aggregated. + openscap-scanner contains the oscap command line tool. This tool is a +configuration and vulnerability scanner, capable of performing compliance checking using +SCAP content.
FAU_GEN.1Disable SSH Root Login + The root user should never be allowed to login to a +system directly over a network. +To disable root login via SSH, add or correct the following line in + + +/etc/ssh/sshd_config: + +
PermitRootLogin no
+ 		+ Even though the communications channel may be encrypted, an additional layer of +security is gained by extending the policy of not logging directly on as root. +In addition, logging in with a user-specific account provides individual +accountability of actions performed on the system and also helps to minimize +direct attack attempts on root's password. +
FAU_GEN.1 Enable auditd Service The auditd service is an essential userspace component of @@ -135,16 +143,15 @@
FAU_GEN.1Set number of records to cause an explicit flush to audit logsInclude Local Events in Audit Logs - To configure Audit daemon to issue an explicit flush to disk command -after writing 50 records, set freq to 50 -in /etc/audit/auditd.conf. + To configure Audit daemon to include local events in Audit logs, set +local_events to yes in /etc/audit/auditd.conf. +This is the default setting. - If option freq isn't set to , the flush to disk -may happen after higher number of records, increasing the danger -of audit loss. + If option local_events isn't set to yes only events from +network will be aggregated.
FAU_GEN.1Disable SSH Root LoginSet number of records to cause an explicit flush to audit logs - The root user should never be allowed to login to a -system directly over a network. -To disable root login via SSH, add or correct the following line in - - -/etc/ssh/sshd_config: - -
PermitRootLogin no
+ To configure Audit daemon to issue an explicit flush to disk command +after writing 50 records, set freq to 50 +in /etc/audit/auditd.conf. 		- Even though the communications channel may be encrypted, an additional layer of -security is gained by extending the policy of not logging directly on as root. -In addition, logging in with a user-specific account provides individual -accountability of actions performed on the system and also helps to minimize -direct attack attempts on root's password. + If option freq isn't set to , the flush to disk +may happen after higher number of records, increasing the danger +of audit loss.
FAU_GEN.1.1.cEnsure auditd Collects Information on the Use of Privileged Commands - ssh-keysign - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
- 		- Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. -

-Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. -
FAU_GEN.1.1.cRecord Unsuccessful Access Attempts to Files - creat - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: -
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: -
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
- 		- Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. -
FAU_GEN.1.1.cRecord Attempts to Alter Process and Session Initiation InformationEnsure auditd Collects Information on Kernel Module Unloading - delete_module - The audit system already collects process information for all -users and root. If the auditd daemon is configured to use the -augenrules program to read audit rules during daemon startup (the -default), add the following lines to a file with suffix .rules in the -directory /etc/audit/rules.d in order to watch for attempted manual /usr/share/doc/scap-security-guide/tables/table-rhel7-pcidssrefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel7-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel7-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -107,29 +107,6 @@
Req-6.2Ensure Software Patches Installed - -If the system is joined to the Red Hat Network, a Red Hat Satellite Server, -or a yum server, run the following command to install updates: -
$ sudo yum update
-If the system is not configured to use one of these sources, updates (in the form of RPM packages) -can be manually downloaded from the Red Hat Network and installed using rpm. - -

-NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy -dictates. - 		- Installing software updates is a fundamental mitigation against -the exploitation of publicly-known vulnerabilities. If the most -recent security patches and updates are not installed, unauthorized -users may take advantage of weaknesses in the unpatched software. The -lack of prompt attention to patching could result in a system compromise. -
Req-6.2 Ensure gpgcheck Enabled In Main yum Configuration The gpgcheck option controls whether @@ -157,15 +134,38 @@
Req-6.2Ensure Software Patches Installed + +If the system is joined to the Red Hat Network, a Red Hat Satellite Server, +or a yum server, run the following command to install updates: +
$ sudo yum update
+If the system is not configured to use one of these sources, updates (in the form of RPM packages) +can be manually downloaded from the Red Hat Network and installed using rpm. + +

+NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy +dictates. + 		+ Installing software updates is a fundamental mitigation against +the exploitation of publicly-known vulnerabilities. If the most +recent security patches and updates are not installed, unauthorized +users may take advantage of weaknesses in the unpatched software. The +lack of prompt attention to patching could result in a system compromise. +
Req-7.1Verify the UEFI Boot Loader grub.cfg User OwnershipVerify /boot/grub2/grub.cfg User Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
+To properly set the owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chown root /boot/grub2/grub.cfg
Only root should be able to modify important boot parameters. @@ -173,14 +173,14 @@
Req-7.1Verify /boot/grub2/grub.cfg Group OwnershipVerify the UEFI Boot Loader grub.cfg Group Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chgrp root /boot/grub2/grub.cfg
+To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -189,14 +189,14 @@
Req-7.1Verify the UEFI Boot Loader grub.cfg Group OwnershipVerify /boot/grub2/grub.cfg Group Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
+To properly set the group owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chgrp root /boot/grub2/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -205,14 +205,14 @@
Req-7.1Verify /boot/grub2/grub.cfg User OwnershipVerify the UEFI Boot Loader grub.cfg User Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chown root /boot/grub2/grub.cfg
+To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
Only root should be able to modify important boot parameters. @@ -295,11 +295,41 @@
Req-8.1.8Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle PeriodSet SSH Idle Timeout Interval - If not already configured, ensure that users cannot change GNOME3 screensaver lock settings -by adding 
/org/gnome/desktop/screensaver/lock-enabled
-to /etc/dconf/db/local.d/00-security-settings. + SSH allows administrators to set an idle timeout interval. After this interval +has passed, the idle user will be automatically logged out. +

+To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as +follows: +
ClientAliveInterval 300
+

+The timeout interval is given in seconds. For example, have a timeout +of 10 minutes, set interval to 600. +

+If a shorter timeout has already been set for the login shell, that value will +preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that +some processes may stop SSH from correctly detecting that the user is idle. + 		+ Terminating an idle ssh session within a short time period reduces the window of +opportunity for unauthorized personnel to take control of a management session +enabled on the console or console port that has been let unattended. +
Req-8.1.8Enable GNOME3 Screensaver Lock After Idle Period + +To activate locking of the screensaver in the GNOME3 desktop when it is activated, +add or set lock-enabled to true in +/etc/dconf/db/local.d/00-security-settings. For example: +
[org/gnome/desktop/screensaver]
+lock-enabled=true
+
+Once the settings have been added, add a lock to +/etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example: 
/org/gnome/desktop/screensaver/lock-enabled
After the settings have been set, run dconf update. @@ -311,6 +341,27 @@
Req-8.1.8Set GNOME3 Screensaver Inactivity Timeout + The idle time-out value for inactivity in the GNOME3 desktop is configured via the idle-delay +setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/local.d directory +and locked in /etc/dconf/db/local.d/locks directory to prevent user modification. +

+For example, to configure the system for a 15 minute delay, add the following to +/etc/dconf/db/local.d/00-security-settings: +
[org/gnome/desktop/session]
+idle-delay=uint32 900
+ 		+ A session time-out lock is a temporary action taken when a user stops work and moves away from +the immediate physical vicinity of the information system but does not logout because of the +temporary nature of the absence. Rather than relying on the user to manually lock their operating +system session prior to vacating the vicinity, GNOME3 can be configured to identify when +a user's session has idled and take action to initiate a session lock. +
BP28(R1)Remove tftp DaemonUninstall talk-server Package - Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, -typically used to automatically transfer configuration or boot files between systems. -TFTP does not support authentication and can be easily hacked. The package -tftp is a client program that allows for connections to a tftp server. + The talk-server package can be removed with the following command: 
 $ sudo yum erase talk-server
 - It is recommended that TFTP be removed, unless there is a specific need -for TFTP (such as a boot server). In that case, use extreme caution when configuring -the services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk-server package decreases the +risk of the accidental (or intentional) activation of talk services.
BP28(R1)Uninstall DHCP Server PackageUninstall ypserv Package - If the system does not need to act as a DHCP server, -the dhcp package can be uninstalled. - -The dhcp-server package can be removed with the following command: + The ypserv package can be removed with the following command: 
-$ sudo yum erase dhcp-server
+$ sudo yum erase ypserv 		- Removing the DHCP server ensures that it cannot be easily or -accidentally reactivated and disrupt network operation. + The NIS service provides an unencrypted authentication service which does +not provide for the confidentiality and integrity of user passwords or the +remote session. + +Removing the ypserv package decreases the risk of the accidental +(or intentional) activation of NIS or NIS+ services.
BP28(R1)Uninstall rsh PackageRemove telnet Clients - -The rsh package contains the client commands - -for the rsh services + The telnet client allows users to start connections to other systems via +the telnet protocol. - These legacy clients contain numerous security exposures and have -been replaced with the more secure SSH package. Even if the server is removed, -it is best to ensure the clients are also removed to prevent users from -inadvertently attempting to use these commands and therefore exposing - -their credentials. Note that removing the rsh package removes - -the clients for rsh,rcp, and rlogin. + The telnet protocol is insecure and unencrypted. The use +of an unencrypted transmission medium could allow an unauthorized user +to steal credentials. The ssh package provides an +encrypted session and stronger security and is included in Red Hat Enterprise Linux 8.
BP28(R1)Uninstall Sendmail PackageUninstall rsh-server Package - Sendmail is not the default mail transfer agent and is -not installed by default. -The sendmail package can be removed with the following command: + The rsh-server package can be removed with the following command: 
-$ sudo yum erase sendmail
+$ sudo yum erase rsh-server 		- The sendmail software was not developed with security in mind and -its design prevents it from being effectively contained by SELinux. Postfix -should be used instead. + The rsh-server service provides unencrypted remote access service which does not +provide for the confidentiality and integrity of user passwords or the remote session and has very weak +authentication. If a privileged user were to login using this service, the privileged user password +could be compromised. The rsh-server package provides several obsolete and insecure +network services. Removing it decreases the risk of those services' accidental (or intentional) +activation.
BP28(R1)Uninstall ypserv PackageUninstall tftp-server Package - The ypserv package can be removed with the following command: + The tftp-server package can be removed with the following command: 
 $ sudo yum erase tftp-server
+ 		+ Removing the tftp-server package decreases the risk of the accidental +(or intentional) activation of tftp services. +

+If TFTP is required for operational support (such as transmission of router +configurations), its use must be documented with the Information Systems +Securty Manager (ISSM), restricted to only authorized personnel, and have +access control rules established. +
BP28(R1)Uninstall talk Package + The talk package contains the client program for the +Internet talk protocol, which allows the user to chat with other users on +different systems. Talk is a communication program which copies lines from one +terminal to the terminal of another user. +The talk package can be removed with the following command: 
-$ sudo yum erase ypserv
+$ sudo yum erase talk 		- The NIS service provides an unencrypted authentication service which does -not provide for the confidentiality and integrity of user passwords or the -remote session. - -Removing the ypserv package decreases the risk of the accidental -(or intentional) activation of NIS or NIS+ services. + The talk software presents a security risk as it uses unencrypted protocols +for communications. Removing the talk package decreases the +risk of the accidental (or intentional) activation of talk client program.
BP28(R1)Remove telnet Clients - The telnet client allows users to start connections to other systems via -the telnet protocol. - - The telnet protocol is insecure and unencrypted. The use -of an unencrypted transmission medium could allow an unauthorized user -to steal credentials. The ssh package provides an -encrypted session and stronger security and is included in Red Hat Enterprise Linux 8. -
BP28(R1)
NT007(R03)		 Uninstall the telnet server @@ -192,82 +188,86 @@
BP28(R1)Uninstall talk PackageRemove NIS Client - The talk package contains the client program for the -Internet talk protocol, which allows the user to chat with other users on -different systems. Talk is a communication program which copies lines from one -terminal to the terminal of another user. -The talk package can be removed with the following command: -
-$ sudo yum erase talk
+ The Network Information Service (NIS), formerly known as Yellow Pages, +is a client-server directory service protocol used to distribute system configuration +files. The NIS client (ypbind) was used to bind a system to an NIS server +and receive the distributed configuration files. 		- The talk software presents a security risk as it uses unencrypted protocols -for communications. Removing the talk package decreases the -risk of the accidental (or intentional) activation of talk client program. + The NIS service is inherently an insecure system that has been vulnerable +to DOS attacks, buffer overflows and has poor authentication for querying +NIS maps. NIS generally has been replaced by such protocols as Lightweight +Directory Access Protocol (LDAP). It is recommended that the service be +removed.
1.1.1.2Disable Mounting of squashfsDisable Mounting of vFAT filesystems -To configure the system to prevent the squashfs -kernel module from being loaded, add the following line to the file /etc/modprobe.d/squashfs.conf: -
install squashfs /bin/true
+To configure the system to prevent the vfat +kernel module from being loaded, add the following line to the file /etc/modprobe.d/vfat.conf: +
install vfat /bin/true
-To configure the system to prevent the squashfs from being used, -add the following line to file /etc/modprobe.d/squashfs.conf: -
blacklist squashfs
+To configure the system to prevent the vfat from being used, +add the following line to file /etc/modprobe.d/vfat.conf: +
blacklist vfat
This effectively prevents usage of this uncommon filesystem. -The squashfs filesystem type is a compressed read-only Linux -filesystem embedded in small footprint systems (similar to -cramfs). A squashfs image can be used without having -to first decompress the image. +The vFAT filesystem format is primarily used on older +windows systems and portable USB drives or flash modules. It comes +in three types FAT12, FAT16, and FAT32 +all of which are supported by the vfat kernel module. 		- Removing support for unneeded filesystem types reduces the local attack + Removing support for unneeded filesystems reduces the local attack surface of the system.
1.1.1.2Disable Mounting of vFAT filesystemsDisable Mounting of squashfs -To configure the system to prevent the vfat -kernel module from being loaded, add the following line to the file /etc/modprobe.d/vfat.conf: -
install vfat /bin/true
+To configure the system to prevent the squashfs +kernel module from being loaded, add the following line to the file /etc/modprobe.d/squashfs.conf: +
install squashfs /bin/true
-To configure the system to prevent the vfat from being used, -add the following line to file /etc/modprobe.d/vfat.conf: -
blacklist vfat
+To configure the system to prevent the squashfs from being used, +add the following line to file /etc/modprobe.d/squashfs.conf: +
blacklist squashfs
This effectively prevents usage of this uncommon filesystem. -The vFAT filesystem format is primarily used on older -windows systems and portable USB drives or flash modules. It comes -in three types FAT12, FAT16, and FAT32 -all of which are supported by the vfat kernel module. +The squashfs filesystem type is a compressed read-only Linux +filesystem embedded in small footprint systems (similar to +cramfs). A squashfs image can be used without having +to first decompress the image. 		- Removing support for unneeded filesystems reduces the local attack + Removing support for unneeded filesystem types reduces the local attack surface of the system.
1.2.2Disable Red Hat Network Service (rhnsd) + The Red Hat Network service automatically queries Red Hat Network +servers to determine whether there are any actions that should be executed, +such as package updates. This only occurs if the system was registered to an +RHN server or satellite and managed as such. + +The rhnsd service can be disabled with the following command: +
$ sudo systemctl mask --now rhnsd.service
+ 		+ Although systems management and patching is extremely important to +system security, management by a system outside the enterprise enclave is not +desirable for some environments. However, if the system is being managed by RHN or + RHN Satellite Server the rhnsd daemon can remain on. +
1.2.2 Ensure Red Hat GPG Key Installed To ensure the system can cryptographically verify base software packages @@ -704,22 +723,19 @@
1.2.2Disable Red Hat Network Service (rhnsd)1.2.3Enable authselect - The Red Hat Network service automatically queries Red Hat Network -servers to determine whether there are any actions that should be executed, -such as package updates. This only occurs if the system was registered to an -RHN server or satellite and managed as such. - -The rhnsd service can be disabled with the following command: -
$ sudo systemctl mask --now rhnsd.service
+ Configure user authentication setup to use the authselect tool. +If authselect profile is selected, the rule will enable the minimal profile. 		- Although systems management and patching is extremely important to -system security, management by a system outside the enterprise enclave is not -desirable for some environments. However, if the system is being managed by RHN or - RHN Satellite Server the rhnsd daemon can remain on. + Authselect is a successor to authconfig. +It is a tool to select system authentication and identity sources from a list of supported +profiles instead of letting the administrator manually build the PAM stack. + +That way, it avoids potential breakage of configuration, as it ships several tested profiles +that are well tested and supported to solve different use-cases.
1.2.3Enable authselect - Configure user authentication setup to use the authselect tool. -If authselect profile is selected, the rule will enable the minimal profile. - - Authselect is a successor to authconfig. -It is a tool to select system authentication and identity sources from a list of supported -profiles instead of letting the administrator manually build the PAM stack. - -That way, it avoids potential breakage of configuration, as it ships several tested profiles -that are well tested and supported to solve different use-cases. -
1.3.1 Install AIDE @@ -837,7 +837,7 @@
1.4.1Set Boot Loader Password in grub2Set the UEFI Boot Loader Password The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. @@ -859,7 +859,7 @@
1.4.1Set the UEFI Boot Loader PasswordSet Boot Loader Password in grub2 The grub2 boot loader should have a superuser account and password protection enabled to protect boot-time settings. @@ -881,14 +881,14 @@
1.4.2Verify the UEFI Boot Loader grub.cfg User OwnershipVerify /boot/grub2/grub.cfg User Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
+To properly set the owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chown root /boot/grub2/grub.cfg
Only root should be able to modify important boot parameters. @@ -896,42 +896,42 @@
3.1.1Disable GDM Automatic Login3.1.1
3.4.5		Require Authentication for Single User Mode - The GNOME Display Manager (GDM) can allow users to automatically login without -user interaction or credentials. User should always be required to authenticate themselves -to the system that they are authorized to use. To disable user ability to automatically -login to the system, set the AutomaticLoginEnable to false in the -[daemon] section in /etc/gdm/custom.conf. For example: -
[daemon]
-AutomaticLoginEnable=false
+ Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup. +

+By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. 		- Failure to restrict system access to authenticated users negatively impacts operating -system security. + This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password. +
3.1.1
3.4.5		Require Authentication for Emergency Systemd Target + Emergency mode is intended as a system recovery +method, providing a single user root access to the system +during a failed boot sequence. +

+By default, Emergency mode is protected by requiring a password and is set +in /usr/lib/systemd/system/emergency.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password.
3.1.1
3.1.5		Disable SSH Access via Empty PasswordsDisable SSH Root Login - Disallow SSH login with empty passwords. -The default SSH configuration disables logins with empty passwords. The appropriate -configuration is used if no value is set for PermitEmptyPasswords. -
-To explicitly disallow SSH login from accounts with empty passwords, -add or correct the following line in + The root user should never be allowed to login to a +system directly over a network. +To disable root login via SSH, add or correct the following line in /etc/ssh/sshd_config: -
-
PermitEmptyPasswords no
-Any accounts with empty passwords should be disabled immediately, and PAM configuration -should prevent users from being able to assign themselves empty passwords. +
PermitRootLogin no
 - Configuring this setting for the SSH daemon provides additional assurance -that remote login via SSH will require a password, even in the event of -misconfiguration elsewhere. + Even though the communications channel may be encrypted, an additional layer of +security is gained by extending the policy of not logging directly on as root. +In addition, logging in with a user-specific account provides individual +accountability of actions performed on the system and also helps to minimize +direct attack attempts on root's password. +
3.1.1
3.1.5		Restrict Virtual Console Root Logins + To restrict root logins through the (deprecated) virtual console devices, +ensure lines of this form do not appear in /etc/securetty: +
vc/1
+vc/2
+vc/3
+vc/4
+ 		+ Preventing direct root login to virtual console devices +helps ensure accountability for actions taken on the system +using the root account. +
3.1.1
3.1.6		Direct root Logins Not Allowed + To further limit access to the root account, administrators +can disable root logins at the console by editing the /etc/securetty file. +This file lists all devices the root user is allowed to login to. If the file does +not exist at all, the root user can login through any communication device on the +system, whether via the console or via a raw network interface. This is dangerous +as user can login to the system as root via Telnet, which sends the password in +plain text over the network. By default, Red Hat Enterprise Linux 8's +/etc/securetty file only allows the root user to login at the console +physically attached to the system. To prevent root from logging in, remove the +contents of this file. To prevent direct root logins, remove the contents of this +file by typing the following command: +
+$ sudo echo > /etc/securetty
+
+ 		+ Disabling direct root logins ensures proper accountability and multifactor +authentication to privileged accounts. Users will first login, then escalate +to privileged (root) access via su / sudo. This is required for FISMA Low +and FISMA Moderate systems.
3.1.1
3.1.5		Restrict Serial Port Root Logins - To restrict root logins on serial ports, -ensure lines of this form do not appear in /etc/securetty: -
ttyS0
-ttyS1
- 		- Preventing direct root login to serial port interfaces -helps ensure accountability for actions taken on the systems -using the root account. -
3.1.1
3.1.5		 Prevent Login to Accounts With Empty Password If an account is configured for password authentication @@ -160,100 +201,59 @@
3.1.1
3.1.5		Restrict Virtual Console Root LoginsRestrict Serial Port Root Logins - To restrict root logins through the (deprecated) virtual console devices, + To restrict root logins on serial ports, ensure lines of this form do not appear in /etc/securetty: -
vc/1
-vc/2
-vc/3
-vc/4
+
ttyS0
+ttyS1
 - Preventing direct root login to virtual console devices -helps ensure accountability for actions taken on the system + Preventing direct root login to serial port interfaces +helps ensure accountability for actions taken on the systems using the root account.
3.1.1
3.1.6		Direct root Logins Not Allowed - To further limit access to the root account, administrators -can disable root logins at the console by editing the /etc/securetty file. -This file lists all devices the root user is allowed to login to. If the file does -not exist at all, the root user can login through any communication device on the -system, whether via the console or via a raw network interface. This is dangerous -as user can login to the system as root via Telnet, which sends the password in -plain text over the network. By default, Red Hat Enterprise Linux 8's -/etc/securetty file only allows the root user to login at the console -physically attached to the system. To prevent root from logging in, remove the -contents of this file. To prevent direct root logins, remove the contents of this -file by typing the following command: -
-$ sudo echo > /etc/securetty
-
- 		- Disabling direct root logins ensures proper accountability and multifactor -authentication to privileged accounts. Users will first login, then escalate -to privileged (root) access via su / sudo. This is required for FISMA Low -and FISMA Moderate systems. /usr/share/doc/scap-security-guide/tables/table-rhel8-nistrefs.html differs (HTML document, UTF-8 Unicode text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel8-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel8-nistrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -74,68 +74,106 @@
AU-2(a)Configure immutable Audit login UIDs + Configure kernel to prevent modification of login UIDs once they are set. +Changing login UIDs while this configuration is enforced requires special capabilities which +are not available to unprivileged users. + +The following rules configure audit as described above: +
## Make the loginuid immutable. This prevents tampering with the auid.
+--loginuid-immutable
+ +Load new Audit rules into kernel by running: +
augenrules --load
+ 		+ If modification of login UIDs is not prevented, they can be changed by unprivileged users and +make auditing complicated or impossible. +
AU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysignEnsure auditd Collects Information on Kernel Module Unloading - delete_module - At a minimum, the audit system should collect the execution of -privileged commands for all users and root. If the auditd daemon is -configured to use the augenrules program to read audit rules during -daemon startup (the default), add a line of the following form to a file with -suffix .rules in the directory /etc/audit/rules.d: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add a line of the following -form to /etc/audit/audit.rules: -
-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged
+ To capture kernel module unloading events, use following line, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: + +
-a always,exit -F arch=ARCH -S delete_module -F auid>=1000 -F auid!=unset -F key=modules
+ + +Place to add the line depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the line to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the line to file /etc/audit/audit.rules. 		- Misuse of privileged functions, either intentionally or unintentionally by -authorized users, or by unauthorized external entities that have compromised system accounts, -is a serious and ongoing concern and can have significant adverse impacts on organizations. -Auditing the use of privileged functions is one way to detect such misuse and identify -the risk from insider and advanced persistent threats. -

-Privileged programs are subject to escalation-of-privilege attacks, -which attempt to subvert their normal role of providing some necessary but -limited capability. As such, motivation exists to monitor these programs for -unusual activity. + The removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Access Attempts to Files - creatAU-2(d)
AU-12(c)
AC-6(9)
CM-6(a)		Ensure auditd Collects Information on Kernel Module Loading and Unloading - At a minimum, the audit system should collect unauthorized file -accesses for all users and root. If the auditd daemon is configured -to use the augenrules program to read audit rules during daemon -startup (the default), add the following lines to a file with suffix -.rules in the directory /etc/audit/rules.d: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: -
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the auditd daemon is configured to use the auditctl -utility to read audit rules during daemon startup, add the following lines to -/etc/audit/audit.rules file: -
-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
-If the system is 64 bit then also add the following lines: + To capture kernel module loading and unloading events, use following lines, setting ARCH to +either b32 for 32-bit system, or having two lines for both b32 and b64 in case your system is 64-bit: 
--a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=access
--a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=access
+-a always,exit -F arch=ARCH -S init_module,finit_module,delete_module -F key=modules + + +The place to add the lines depends on a way auditd daemon is configured. If it is configured +to use the augenrules program (the default), add the lines to a file with suffix +.rules in the directory /etc/audit/rules.d. + +If the auditd daemon is configured to use the auditctl utility, +add the lines to file /etc/audit/audit.rules. 		- Unsuccessful attempts to access files could be an indicator of malicious activity on a system. Auditing -these events could serve as evidence of potential system compromise. + The addition/removal of kernel modules can be used to alter the behavior of +the kernel and potentially introduce malicious code into kernel space. It is important +to have an audit trail of modules that have been introduced into the kernel. +
AU-2(a)Configure auditing of unsuccessful file creations + Ensure that unsuccessful attempts to create a file are audited. + +The following rules configure audit as described above: +
## Unsuccessful file creation (open with O_CREAT)
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S openat,open_by_handle_at -F a2&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S open -F a1&0100 -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+-a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccessful-create
+ +Load new Audit rules into kernel by running: +
augenrules --load
+ +Note: This rule uses a special set of Audit rules to comply with OSPP 4.2.1. You may reuse this rule in different profiles. If you decide to do so, it is recommended that you inspect contents of the file closely and make sure that they are alligned with your needs. + 		+ Unsuccessful file creations might be a sign of a malicious action being performed on the system. Keeping log of such events helps in monitoring and investigation of such actions.
AU-2(d)
AU-12(c)
CM-6(a)		Record Unsuccessful Permission Changes to Files - fsetxattrRecord Unsuccessful Ownership Changes to Files - fchown - The audit system should collect unsuccessful file permission change + The audit system should collect unsuccessful file ownership change attempts for all users and root. If the auditd daemon is configured to use the augenrules program to read audit rules during daemon @@ -144,40 +182,125 @@ If the auditd daemon is configured to use the auditctl utility to read audit rules during daemon startup, add the following lines to /etc/audit/audit.rules file. -
-a always,exit -F arch=b32 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
--a always,exit -F arch=b32 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+
-a always,exit -F arch=b32 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b32 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
If the system is 64 bit then also add the following lines: -
-a always,exit -F arch=b64 -S fsetxattr -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
--a always,exit -F arch=b64 -S fsetxattr -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+
-a always,exit -F arch=b64 -S fchown -F exit=-EACCES -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
+-a always,exit -F arch=b64 -S fchown -F exit=-EPERM -F auid>=1000 -F auid!=unset -F key=unsuccesful-perm-change
 - Unsuccessful attempts to change permissions of files could be an indicator of malicious activity on a system. Auditing + Unsuccessful attempts to change ownership of files could be an indicator of malicious activity on a system. Auditing these events could serve as evidence of potential system compromise.
AU-2(a)Configure auditing of successful permission changesIA-2
AC-3
CM-6(a)		Require Authentication for Single User Mode - Ensure that successful attempts to modify permissions of files or directories are audited. + Single-user mode is intended as a system recovery +method, providing a single user root access to the system by +providing a boot option at startup. +

+By default, single-user mode is protected by requiring a password and is set +in /usr/lib/systemd/system/rescue.service. + 		+ This prevents attackers with physical access from trivially bypassing security +on the machine and gaining root access. Such accesses are further prevented +by configuring the bootloader password. +
AU-2(d)
AU-12(c)
CM-6(a)		Record Events that Modify the System's Discretionary Access Controls - fchown + At a minimum, the audit system should collect file permission /usr/share/doc/scap-security-guide/tables/table-rhel8-pcidssrefs.html differs (HTML document, ASCII text, with very long lines) --- old//usr/share/doc/scap-security-guide/tables/table-rhel8-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 +++ new//usr/share/doc/scap-security-guide/tables/table-rhel8-pcidssrefs.html 2022-10-05 00:00:00.000000000 +0000 @@ -107,29 +107,6 @@
Req-6.2Ensure Software Patches Installed - -If the system is joined to the Red Hat Network, a Red Hat Satellite Server, -or a yum server, run the following command to install updates: -
$ sudo yum update
-If the system is not configured to use one of these sources, updates (in the form of RPM packages) -can be manually downloaded from the Red Hat Network and installed using rpm. - -

-NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy -dictates. - 		- Installing software updates is a fundamental mitigation against -the exploitation of publicly-known vulnerabilities. If the most -recent security patches and updates are not installed, unauthorized -users may take advantage of weaknesses in the unpatched software. The -lack of prompt attention to patching could result in a system compromise. -
Req-6.2 Ensure gpgcheck Enabled In Main yum Configuration The gpgcheck option controls whether @@ -157,15 +134,38 @@
Req-6.2Ensure Software Patches Installed + +If the system is joined to the Red Hat Network, a Red Hat Satellite Server, +or a yum server, run the following command to install updates: +
$ sudo yum update
+If the system is not configured to use one of these sources, updates (in the form of RPM packages) +can be manually downloaded from the Red Hat Network and installed using rpm. + +

+NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy +dictates. + 		+ Installing software updates is a fundamental mitigation against +the exploitation of publicly-known vulnerabilities. If the most +recent security patches and updates are not installed, unauthorized +users may take advantage of weaknesses in the unpatched software. The +lack of prompt attention to patching could result in a system compromise. +
Req-7.1Verify the UEFI Boot Loader grub.cfg User OwnershipVerify /boot/grub2/grub.cfg User Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
+To properly set the owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chown root /boot/grub2/grub.cfg
Only root should be able to modify important boot parameters. @@ -173,14 +173,14 @@
Req-7.1Verify /boot/grub2/grub.cfg Group OwnershipVerify the UEFI Boot Loader grub.cfg Group Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chgrp root /boot/grub2/grub.cfg
+To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -189,14 +189,14 @@
Req-7.1Verify the UEFI Boot Loader grub.cfg Group OwnershipVerify /boot/grub2/grub.cfg Group Ownership - The file /boot/efi/EFI/redhat/grub.cfg should + The file /boot/grub2/grub.cfg should be group-owned by the root group to prevent destruction or modification of the file. -To properly set the group owner of /boot/efi/EFI/redhat/grub.cfg, run the command: -
$ sudo chgrp root /boot/efi/EFI/redhat/grub.cfg
+To properly set the group owner of /boot/grub2/grub.cfg, run the command: +
$ sudo chgrp root /boot/grub2/grub.cfg
 The root group is a highly-privileged group. Furthermore, the group-owner of this @@ -205,14 +205,14 @@
Req-7.1Verify /boot/grub2/grub.cfg User OwnershipVerify the UEFI Boot Loader grub.cfg User Ownership - The file /boot/grub2/grub.cfg should + The file /boot/efi/EFI/redhat/grub.cfg should be owned by the root user to prevent destruction or modification of the file. -To properly set the owner of /boot/grub2/grub.cfg, run the command: -
$ sudo chown root /boot/grub2/grub.cfg
+To properly set the owner of /boot/efi/EFI/redhat/grub.cfg, run the command: +
$ sudo chown root /boot/efi/EFI/redhat/grub.cfg
Only root should be able to modify important boot parameters. @@ -295,11 +295,41 @@
Req-8.1.8Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle PeriodSet SSH Idle Timeout Interval - If not already configured, ensure that users cannot change GNOME3 screensaver lock settings -by adding 
/org/gnome/desktop/screensaver/lock-enabled
-to /etc/dconf/db/local.d/00-security-settings. + SSH allows administrators to set an idle timeout interval. After this interval +has passed, the idle user will be automatically logged out. +

+To set an idle timeout interval, edit the following line in /etc/ssh/sshd_config as +follows: +
ClientAliveInterval 300
+

+The timeout interval is given in seconds. For example, have a timeout +of 10 minutes, set interval to 600. +

+If a shorter timeout has already been set for the login shell, that value will +preempt any SSH setting made in /etc/ssh/sshd_config. Keep in mind that +some processes may stop SSH from correctly detecting that the user is idle. + 		+ Terminating an idle ssh session within a short time period reduces the window of +opportunity for unauthorized personnel to take control of a management session +enabled on the console or console port that has been let unattended. +
Req-8.1.8Enable GNOME3 Screensaver Lock After Idle Period + +To activate locking of the screensaver in the GNOME3 desktop when it is activated, +add or set lock-enabled to true in +/etc/dconf/db/local.d/00-security-settings. For example: +
[org/gnome/desktop/screensaver]
+lock-enabled=true
+
+Once the settings have been added, add a lock to +/etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification. For example: 
/org/gnome/desktop/screensaver/lock-enabled
After the settings have been set, run dconf update. @@ -311,6 +341,27 @@
Req-8.1.8Set GNOME3 Screensaver Inactivity Timeout + The idle time-out value for inactivity in the GNOME3 desktop is configured via the idle-delay +setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/local.d directory +and locked in /etc/dconf/db/local.d/locks directory to prevent user modification. +

+For example, to configure the system for a 15 minute delay, add the following to +/etc/dconf/db/local.d/00-security-settings: +
[org/gnome/desktop/session]
+idle-delay=uint32 900
+ 		+ A session time-out lock is a temporary action taken when a user stops work and moves away from +the immediate physical vicinity of the information system but does not logout because of the +temporary nature of the absence. Rather than relying on the user to manually lock their operating +system session prior to vacating the vicinity, GNOME3 can be configured to identify when +a user's session has idled and take action to initiate a session lock. +
Profile TitleProfile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_average

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 16.04   Group contains 19 groups and 40 rules
Group   @@ -1540,14 +1540,7 @@   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1555,6 +1548,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1572,14 +1572,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1587,6 +1580,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1600,14 +1600,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1615,6 +1608,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
+  package { 'ntpdate':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure ntpdate is removed
   package:
     name: ntpdate
@@ -1630,14 +1630,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd-ssl
 #	   from the system, and may remove any packages
 #	   that depend on telnetd-ssl. Execute this
@@ -1645,6 +1638,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd-ssl"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
+
+class remove_telnetd-ssl {
+  package { 'telnetd-ssl':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
   package:
     name: telnetd-ssl
@@ -1664,14 +1664,7 @@
                                   [ref]
The telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd_removed
Identifiers and References

References:  - BP28(R1), NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
-
-class remove_telnetd {
-  package { 'telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd
 #	   from the system, and may remove any packages
 #	   that depend on telnetd. Execute this
@@ -1679,6 +1672,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
+
+class remove_telnetd {
+  package { 'telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd is removed
   package:
     name: telnetd
@@ -1757,14 +1757,7 @@
 information on the capabilities and configuration of each of the NTP daemons.

Rule   Install the ntp service   [ref]

The ntpd service should be installed.
Rationale:
Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_ntp_installed
Identifiers and References

References:  - NT012(R03), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000160, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.4


Complexity:low
Disruption:low
Strategy:enable
include install_ntp
-
-class install_ntp {
-  package { 'ntp':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            NT012(R03), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000160, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.4

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "ntp"
@@ -1772,10 +1765,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "ntp"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_ntp
+
+class install_ntp {
+  package { 'ntp':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure ntp is installed
   package:
     name: ntp
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 High (Enforced) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_high

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 16.04   Group contains 22 groups and 46 rules
Group   @@ -354,14 +354,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -369,10 +362,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -407,15 +407,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'audit' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -426,9 +418,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -1805,14 +1805,7 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include install_cron
-
-class install_cron {
-  package { 'cron':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "cron"
@@ -1820,10 +1813,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "cron"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
+
+class install_cron {
+  package { 'cron':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1846,14 +1846,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1861,6 +1854,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1878,14 +1878,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1893,6 +1886,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1906,14 +1906,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1921,6 +1914,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services

Checklist

Group   Guide to the Secure Configuration of Ubuntu 16.04   Group contains 9 groups and 19 rules
Group   @@ -754,14 +754,7 @@   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -769,6 +762,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -786,14 +786,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -801,6 +794,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -816,14 +816,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd-ssl
 #	   from the system, and may remove any packages
 #	   that depend on telnetd-ssl. Execute this
@@ -831,6 +824,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd-ssl"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
+
+class remove_telnetd-ssl {
+  package { 'telnetd-ssl':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
   package:
     name: telnetd-ssl
@@ -850,14 +850,7 @@
                                   [ref]
The telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd_removed
Identifiers and References

References:  - BP28(R1), NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
-
-class remove_telnetd {
-  package { 'telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd
 #	   from the system, and may remove any packages
 #	   that depend on telnetd. Execute this
@@ -865,6 +858,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
+
+class remove_telnetd {
+  package { 'telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd is removed
   package:
     name: telnetd
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_restrictive.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Restrictive Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 16.04   Group contains 21 groups and 45 rules
Group   @@ -354,14 +354,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -369,10 +362,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -407,15 +407,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'audit' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -426,9 +418,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -1762,14 +1762,7 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include install_cron
-
-class install_cron {
-  package { 'cron':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "cron"
@@ -1777,10 +1770,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "cron"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
+
+class install_cron {
+  package { 'cron':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1803,14 +1803,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1818,6 +1811,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1835,14 +1835,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1850,6 +1843,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1863,14 +1863,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1878,6 +1871,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1604-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Ubuntu 16.04
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 16.04   Group contains 19 groups and 45 rules
Group   @@ -230,14 +230,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -245,10 +238,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -283,15 +283,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'audit' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -302,9 +294,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -568,14 +568,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -583,10 +576,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -607,15 +607,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -626,9 +618,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1720,14 +1720,7 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include install_cron
-
-class install_cron {
-  package { 'cron':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "cron"
@@ -1735,10 +1728,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "cron"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
+
+class install_cron {
+  package { 'cron':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1761,15 +1761,7 @@
 The cron service can be enabled with the following command:
 
$ sudo systemctl enable cron.service
Rationale:
Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_cron_enabled
Identifiers and References

References:  - 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include enable_cron
-
-class enable_cron {
-  service {'cron':
-    enable => true,
-    ensure => 'running',
-  }
-}
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_average.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_average.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Average (Intermediate) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_average

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Configure Syslog
    3. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 18.04   Group contains 19 groups and 40 rules
Group   @@ -1540,14 +1540,7 @@   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1555,6 +1548,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1572,14 +1572,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1587,6 +1580,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1600,14 +1600,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1615,6 +1608,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
+  package { 'ntpdate':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure ntpdate is removed
   package:
     name: ntpdate
@@ -1630,14 +1630,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd-ssl
 #	   from the system, and may remove any packages
 #	   that depend on telnetd-ssl. Execute this
@@ -1645,6 +1638,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd-ssl"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
+
+class remove_telnetd-ssl {
+  package { 'telnetd-ssl':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
   package:
     name: telnetd-ssl
@@ -1664,14 +1664,7 @@
                                   [ref]
The telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd_removed
Identifiers and References

References:  - BP28(R1), NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
-
-class remove_telnetd {
-  package { 'telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd
 #	   from the system, and may remove any packages
 #	   that depend on telnetd. Execute this
@@ -1679,6 +1672,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
+
+class remove_telnetd {
+  package { 'telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd is removed
   package:
     name: telnetd
@@ -1757,14 +1757,7 @@
 information on the capabilities and configuration of each of the NTP daemons.

Rule   Install the ntp service   [ref]

The ntpd service should be installed.
Rationale:
Time synchronization (using NTP) is required by almost all network and administrative tasks (syslog, cryptographic based services (authentication, etc.), etc.). Ntpd is regulary maintained and updated, supporting security features such as RFC 5906.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_ntp_installed
Identifiers and References

References:  - NT012(R03), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000160, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.4


Complexity:low
Disruption:low
Strategy:enable
include install_ntp
-
-class install_ntp {
-  package { 'ntp':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            NT012(R03), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-000160, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, Req-10.4

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "ntp"
@@ -1772,10 +1765,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "ntp"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_ntp
+
+class install_ntp {
+  package { 'ntp':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure ntp is installed
   package:
     name: ntp
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_high.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_high.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 High (Enforced) Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_high

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 18.04   Group contains 22 groups and 46 rules
Group   @@ -354,14 +354,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -369,10 +362,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -407,15 +407,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'audit' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -426,9 +418,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -1805,14 +1805,7 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include install_cron
-
-class install_cron {
-  package { 'cron':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "cron"
@@ -1820,10 +1813,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "cron"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
+
+class install_cron {
+  package { 'cron':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1846,14 +1846,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1861,6 +1854,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1878,14 +1878,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1893,6 +1886,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1906,14 +1906,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1921,6 +1914,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_minimal.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_minimal.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Minimal Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Deprecated services

Checklist

Group   Guide to the Secure Configuration of Ubuntu 18.04   Group contains 9 groups and 19 rules
Group   @@ -754,14 +754,7 @@   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -769,6 +762,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -786,14 +786,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -801,6 +794,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -816,14 +816,7 @@
                                 Uninstall the ssl compliant telnet server
                                   [ref]
The telnet daemon, even with ssl support, should be uninstalled.
Rationale:
telnet, even with ssl support, should not be installed. When remote shell is required, up-to-date ssh daemon can be used.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd-ssl_removed
Identifiers and References

References:  - NT007(R02), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
-
-class remove_telnetd-ssl {
-  package { 'telnetd-ssl':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd-ssl
 #	   from the system, and may remove any packages
 #	   that depend on telnetd-ssl. Execute this
@@ -831,6 +824,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd-ssl"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd-ssl
+
+class remove_telnetd-ssl {
+  package { 'telnetd-ssl':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd-ssl is removed
   package:
     name: telnetd-ssl
@@ -850,14 +850,7 @@
                                   [ref]
The telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.'
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_telnetd_removed
Identifiers and References

References:  - BP28(R1), NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
-
-class remove_telnetd {
-  package { 'telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove telnetd
 #	   from the system, and may remove any packages
 #	   that depend on telnetd. Execute this
@@ -865,6 +858,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_telnetd
+
+class remove_telnetd {
+  package { 'telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure telnetd is removed
   package:
     name: telnetd
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_restrictive.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-anssi_np_nt28_restrictive.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleProfile for ANSSI DAT-NT28 Restrictive Level
Profile IDxccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 18.04   Group contains 21 groups and 45 rules
Group   @@ -354,14 +354,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -369,10 +362,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -407,15 +407,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'audit' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -426,9 +418,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -1762,14 +1762,7 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include install_cron
-
-class install_cron {
-  package { 'cron':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "cron"
@@ -1777,10 +1770,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "cron"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
+
+class install_cron {
+  package { 'cron':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1803,14 +1803,7 @@
                                   [ref]
The inet-based telnet daemon should be uninstalled.
Rationale:
telnet allows clear text communications, and does not protect any data transmission between client and server. Any confidential data can be listened and no integrity checking is made.
Severity: 
high
Rule ID:xccdf_org.ssgproject.content_rule_package_inetutils-telnetd_removed
Identifiers and References

References:  - NT007(R03), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4


Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
-
-class remove_inetutils-telnetd {
-  package { 'inetutils-telnetd':
-    ensure => 'purged',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove inetutils-telnetd
 #	   from the system, and may remove any packages
 #	   that depend on inetutils-telnetd. Execute this
@@ -1818,6 +1811,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "inetutils-telnetd"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_inetutils-telnetd
+
+class remove_inetutils-telnetd {
+  package { 'inetutils-telnetd':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure inetutils-telnetd is removed
   package:
     name: inetutils-telnetd
@@ -1835,14 +1835,7 @@

Rule   Uninstall the nis package   [ref]

The support for Yellowpages should not be installed unless it is required.
Rationale:
NIS is the historical SUN service for central account management, more and more replaced by LDAP. -NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
-
-class remove_nis {
-  package { 'nis':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+NIS does not support efficiently security constraints, ACL, etc. and should not be used.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_nis_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove nis
 #	   from the system, and may remove any packages
 #	   that depend on nis. Execute this
@@ -1850,6 +1843,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "nis"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_nis
+
+class remove_nis {
+  package { 'nis':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Ensure nis is removed
   package:
     name: nis
@@ -1863,14 +1863,7 @@
   - package_nis_removed

Rule   Uninstall the ntpdate package -   [ref]

ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
-
-class remove_ntpdate {
-  package { 'ntpdate':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+                                  [ref]
ntpdate is a historical ntp synchronization client for unixes. It sould be uninstalled.
Rationale:
ntpdate is an old not security-compliant ntp client. It should be replaced by modern ntp clients such as ntpd, able to use cryptographic mechanisms integrated in NTP.
Severity: 
low
Rule ID:xccdf_org.ssgproject.content_rule_package_ntpdate_removed
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 # CAUTION: This remediation script will remove ntpdate
 #	   from the system, and may remove any packages
 #	   that depend on ntpdate. Execute this
@@ -1878,6 +1871,13 @@
 #	   system!
 
 DEBIAN_FRONTEND=noninteractive apt-get remove -y "ntpdate"
+

Complexity:low
Disruption:low
Strategy:disable
include remove_ntpdate
+
+class remove_ntpdate {
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-cis.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-cis.html	2022-10-05 00:00:00.000000000 +0000
@@ -67,7 +67,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 18.04 LTS Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Network Configuration and Firewalls
    4. File Permissions and Masks
  2. Services
    1. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 18.04   Group contains 21 groups and 71 rules
Group   @@ -1280,15 +1280,7 @@ Additionally, a properly configured audit subsystem ensures that actions of individual system users can be uniquely traced to those users so they can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'audit' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -1299,9 +1291,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu1804-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Ubuntu 18.04
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. System Accounting with auditd
    3. Configure Syslog
    4. File Permissions and Masks
  2. Services
    1. Cron and At Daemons
    2. Deprecated services
    3. Network Time Protocol
    4. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 18.04   Group contains 19 groups and 45 rules
Group   @@ -228,14 +228,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -243,10 +236,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -281,15 +281,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'audit' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -300,9 +292,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -566,14 +566,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -581,10 +574,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -605,15 +605,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -624,9 +616,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1718,14 +1718,7 @@
 configured defensively.

Rule   Install the cron service   [ref]

The Cron service should be installed.
Rationale:
The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_cron_installed
Identifiers and References

References:  - BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include install_cron
-
-class install_cron {
-  package { 'cron':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "cron"
@@ -1733,10 +1726,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "cron"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_cron
+
+class install_cron {
+  package { 'cron':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure cron is installed
   package:
     name: cron
@@ -1759,15 +1759,7 @@
 The cron service can be enabled with the following command:
 
$ sudo systemctl enable cron.service
Rationale:
Due to its usage for maintenance and security-supporting tasks, enabling the cron daemon is essential.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_cron_enabled
Identifiers and References

References:  - 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3


Complexity:low
Disruption:low
Strategy:enable
include enable_cron
-
-class enable_cron {
-  service {'cron':
-    enable => true,
-    ensure => 'running',
-  }
-}
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_server.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_server.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_server.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 20.04 Level 1 Server Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level1_server

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Print Support
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of Ubuntu 20.04   Group contains 81 groups and 189 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, UBTU-20-010450, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -463,14 +463,7 @@
 
$ sudo apt remove gdm3
Rationale:
Unnecessary service packages must not be installed to decrease the attack surface of the system. A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm3
-
-class remove_gdm3 {
-  package { 'gdm3':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
 # CAUTION: This remediation script will remove gdm3
@@ -484,6 +477,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm3
+
+class remove_gdm3 {
+  package { 'gdm3':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -530,14 +530,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -545,10 +538,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -2943,14 +2943,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -2958,10 +2951,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -2982,15 +2982,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, UBTU-20-010432, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3001,9 +2993,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -3098,15 +3098,7 @@
 The iptables service can be enabled with the following command:
 
$ sudo systemctl enable iptables.service
Rationale:
The iptables service provides the system's host-based firewalling capability for IPv4 and ICMP.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_iptables_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 6, 8, 9, APO01.06, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, 3.5.3.1.1


Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
-
-class enable_iptables {
-  service {'iptables':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3117,9 +3109,17 @@
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_workstation.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_workstation.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level1_workstation.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 20.04 Level 1 Workstation Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level1_workstation

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Proxy Server
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 20.04   Group contains 78 groups and 188 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, UBTU-20-010450, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -557,14 +557,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -572,10 +565,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -3139,14 +3139,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -3154,10 +3147,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -3178,15 +3178,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, UBTU-20-010432, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3197,9 +3189,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -3294,15 +3294,7 @@
 The iptables service can be enabled with the following command:
 
$ sudo systemctl enable iptables.service
Rationale:
The iptables service provides the system's host-based firewalling capability for IPv4 and ICMP.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_iptables_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 6, 8, 9, APO01.06, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, 3.5.3.1.1


Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
-
-class enable_iptables {
-  service {'iptables':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3313,9 +3305,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["iptables"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
+
+class enable_iptables {
+  service {'iptables':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service iptables
   block:
 
@@ -3407,19 +3407,19 @@
 $ apt-get install iptables
Rationale:
iptables controls the Linux kernel network packet filtering code. iptables allows system operators to set up firewalls and IP masquerading, etc.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_iptables_installed
Identifiers and References

References:  - CM-6(a), SRG-OS-000480-GPOS-00227, 3.5.3.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_iptables
+            CM-6(a), SRG-OS-000480-GPOS-00227, 3.5.3.1.1

Complexity:low
Disruption:low
Strategy:enable

+DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables"
+


+[[packages]]
+name = "iptables"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_iptables
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_server.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_server.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_server.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 20.04 Level 2 Server Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level2_server

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Print Support
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of Ubuntu 20.04   Group contains 92 groups and 273 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, UBTU-20-010450, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -508,14 +508,7 @@
 
$ sudo apt remove gdm3
Rationale:
Unnecessary service packages must not be installed to decrease the attack surface of the system. A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm3
-
-class remove_gdm3 {
-  package { 'gdm3':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
 # CAUTION: This remediation script will remove gdm3
@@ -529,6 +522,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm3
+
+class remove_gdm3 {
+  package { 'gdm3':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -575,14 +575,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -590,10 +583,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -36989,14 +36989,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, UBTU-20-010182, 4.1.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -37004,10 +36997,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -37043,15 +37043,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -37062,9 +37054,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -37467,14 +37467,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -37482,10 +37475,17 @@
 else
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_workstation.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_workstation.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-cis_level2_workstation.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 20.04 Level 2 Workstation Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level2_workstation

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Print Support
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 20.04   Group contains 92 groups and 275 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, UBTU-20-010450, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -602,14 +602,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -617,10 +610,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -37185,14 +37185,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, UBTU-20-010182, 4.1.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -37200,10 +37193,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -37239,15 +37239,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -37258,9 +37250,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -37663,14 +37663,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -37678,10 +37671,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -37702,15 +37702,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, UBTU-20-010432, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Ubuntu 20.04
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Apport Service
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 20.04   Group contains 22 groups and 45 rules
Group   @@ -257,14 +257,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, UBTU-20-010182, 4.1.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_auditd
-
-class install_auditd {
-  package { 'auditd':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "auditd"
@@ -272,10 +265,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "auditd"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_auditd
+
+class install_auditd {
+  package { 'auditd':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure auditd is installed
   package:
     name: auditd
@@ -311,15 +311,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -330,9 +322,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -596,14 +596,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -611,10 +604,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -635,15 +635,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, UBTU-20-010432, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -654,9 +646,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1755,29 +1755,7 @@
 
$ sudo systemctl mask --now apport.service
Rationale:
The Apport service modifies the kernel fs.suid_dumpable configuration at runtime which prevents other hardening from being persistent. Disabling the -service prevents this behavior.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_service_apport_disabled
Identifiers and References

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: apport.service
-        enabled: false
-        mask: true
-      - name: apport.socket
-        enabled: false
-        mask: true
-

Complexity:low
Disruption:low
Strategy:enable
include disable_apport
-
-class disable_apport {
-  service {'apport':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+service prevents this behavior.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_service_apport_disabled
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'apport.service'
@@ -1792,10 +1770,18 @@
 # so let's reset the state so OVAL checks pass.
 # Service should be 'inactive', not 'failed' after reboot though.
 "$SYSTEMCTL_EXEC" reset-failed 'apport.service' || true
-


+


 [customizations.services]
 disabled = ["apport"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service apport
+

Complexity:low
Disruption:low
Strategy:enable
include disable_apport
+
+class disable_apport {
+  service {'apport':
+    enable => false,
+    ensure => 'stopped',
+  }
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-stig.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2004-guide-stig.html	2022-10-05 00:00:00.000000000 +0000
@@ -68,7 +68,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCanonical Ubuntu 20.04 LTS Security Technical Implementation Guide (STIG) V1R1
Profile IDxccdf_org.ssgproject.content_profile_stig

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. AppArmor
    5. GRUB2 bootloader configuration
    6. Configure Syslog
    7. Network Configuration and Firewalls
    8. File Permissions and Masks
  2. Services
    1. APT service configuration
    2. Base Services
    3. Deprecated services
    4. Network Time Protocol
    5. Obsolete Services
    6. SSH Server
    7. System Security Services Daemon

Checklist

Group   Guide to the Secure Configuration of Ubuntu 20.04   Group contains 74 groups and 190 rules
Group   @@ -112,14 +112,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, UBTU-20-010450, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -127,10 +120,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -2198,19 +2198,19 @@
 of the effectiveness of a password in resisting attempts at guessing and
 brute-force attacks. "pwquality" enforces complex password construction
 configuration and has the ability to limit brute-force attacks on the system.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_pam_pwquality_installed
Identifiers and References

References:  - CCI-000366, SRG-OS-000480-GPOS-00225, UBTU-20-010057


Complexity:low
Disruption:low
Strategy:enable
include install_libpam-pwquality
+            CCI-000366, SRG-OS-000480-GPOS-00225, UBTU-20-010057

Complexity:low
Disruption:low
Strategy:enable

+DEBIAN_FRONTEND=noninteractive apt-get install -y "libpam-pwquality"
+


+[[packages]]
+name = "libpam-pwquality"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_libpam-pwquality
 
 class install_libpam-pwquality {
   package { 'libpam-pwquality':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-DEBIAN_FRONTEND=noninteractive apt-get install -y "libpam-pwquality"
-


-[[packages]]
-name = "libpam-pwquality"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure libpam-pwquality is installed
   package:
     name: libpam-pwquality
@@ -2382,19 +2382,19 @@
 once invoked, the session lock must remain in place until the user
 reauthenticates. No other activity aside from reauthentication must
 unlock the system.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_vlock_installed
Identifiers and References

References:  - CCI-000056, CCI-000058, CCI-000060, SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011, UBTU-20-010005


Complexity:low
Disruption:low
Strategy:enable
include install_vlock
+            CCI-000056, CCI-000058, CCI-000060, SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011, UBTU-20-010005

Complexity:low
Disruption:low
Strategy:enable

+DEBIAN_FRONTEND=noninteractive apt-get install -y "vlock"
+


+[[packages]]
+name = "vlock"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_vlock
 
 class install_vlock {
   package { 'vlock':
     ensure => 'installed',
   }
 }
-

Complexity:low
Disruption:low
Strategy:enable

-DEBIAN_FRONTEND=noninteractive apt-get install -y "vlock"
-


-[[packages]]
-name = "vlock"
-version = "*"

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure vlock is installed
   package:
     name: vlock
@@ -2430,14 +2430,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_opensc_installed
Identifiers and References

References:  - CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, UBTU-20-010064


Complexity:low
Disruption:low
Strategy:enable
include install_opensc-pkcs11
-
-class install_opensc-pkcs11 {
-  package { 'opensc-pkcs11':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001954, CCI-001953, 1382, 1384, 1386, CM-6(a), SRG-OS-000375-GPOS-00160, SRG-OS-000376-GPOS-00161, SRG-OS-000376-VMM-001520, UBTU-20-010064

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "opensc-pkcs11"
@@ -2445,10 +2438,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "opensc-pkcs11"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_opensc-pkcs11
+
+class install_opensc-pkcs11 {
+  package { 'opensc-pkcs11':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure opensc-pkcs11 is installed
   package:
     name: opensc-pkcs11
@@ -2480,14 +2480,7 @@
 providing time-based or challenge-response authenticators and smart cards such
 as the U.S. Government Personal Identity Verification card and the DoD Common
 Access Card.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_install_smartcard_packages
Identifiers and References

References:  - CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, UBTU-20-010063


Complexity:low
Disruption:low
Strategy:enable
include install_libpam-pkcs11
-
-class install_libpam-pkcs11 {
-  package { 'libpam-pkcs11':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-000765, CCI-001948, CCI-001953, CCI-001954, CM-6(a), SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162, UBTU-20-010063

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { ! grep -q s390x /proc/sys/kernel/osrelease; }; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "libpam-pkcs11"
@@ -2495,10 +2488,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "libpam-pkcs11"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_libpam-pkcs11
+
+class install_libpam-pkcs11 {
+  package { 'libpam-pkcs11':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure libpam-pkcs11 is installed
   package:
     name: libpam-pkcs11
@@ -40018,14 +40018,7 @@
             CCI-001851, SRG-OS-000479-GPOS-00224, UBTU-20-010300

Rule   Ensure the default plugins for the audit dispatcher are Installed   [ref]

The audit-audispd-plugins package should be installed.
Rationale:
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit-audispd-plugins_installed
Identifiers and References

References:  - CCI-001851, SRG-OS-000342-GPOS-00133, UBTU-20-010216


Complexity:low
Disruption:low
Strategy:enable
include install_audispd-plugins
-
-class install_audispd-plugins {
-  package { 'audispd-plugins':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            CCI-001851, SRG-OS-000342-GPOS-00133, UBTU-20-010216

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "audispd-plugins"
@@ -40033,10 +40026,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audispd-plugins"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audispd-plugins
+
+class install_audispd-plugins {
+  package { 'audispd-plugins':
+    ensure => 'installed',
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_server.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_server.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_server.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 22.04 Level 1 Server Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level1_server

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Print Support
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of Ubuntu 22.04   Group contains 81 groups and 189 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -457,14 +457,7 @@
 
$ sudo apt remove gdm3
Rationale:
Unnecessary service packages must not be installed to decrease the attack surface of the system. A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
 # CAUTION: This remediation script will remove gdm
@@ -478,6 +471,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
+
+class remove_gdm {
+  package { 'gdm':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -524,14 +524,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -539,10 +532,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -2927,14 +2927,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -2942,10 +2935,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -2966,15 +2966,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -2985,9 +2977,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -3081,15 +3081,7 @@
 The iptables service can be enabled with the following command:
 
$ sudo systemctl enable iptables.service
Rationale:
The iptables service provides the system's host-based firewalling capability for IPv4 and ICMP.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_iptables_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 6, 8, 9, APO01.06, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, 3.5.3.1.1


Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
-
-class enable_iptables {
-  service {'iptables':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3100,9 +3092,17 @@
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_workstation.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_workstation.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level1_workstation.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 22.04 Level 1 Workstation Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level1_workstation

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. GRUB2 bootloader configuration
    4. Configure Syslog
    5. Network Configuration and Firewalls
    6. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Proxy Server
    13. Samba(SMB) Microsoft Windows File Sharing Server
    14. SNMP Server
    15. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 22.04   Group contains 78 groups and 188 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -551,14 +551,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -566,10 +559,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -3123,14 +3123,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -3138,10 +3131,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -3162,15 +3162,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3181,9 +3173,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -3277,15 +3277,7 @@
 The iptables service can be enabled with the following command:
 
$ sudo systemctl enable iptables.service
Rationale:
The iptables service provides the system's host-based firewalling capability for IPv4 and ICMP.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_iptables_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 6, 8, 9, APO01.06, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, 3.5.3.1.1


Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
-
-class enable_iptables {
-  service {'iptables':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -3296,9 +3288,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["iptables"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_iptables
+
+class enable_iptables {
+  service {'iptables':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service iptables
   block:
 
@@ -3390,19 +3390,19 @@
 $ apt-get install iptables
Rationale:
iptables controls the Linux kernel network packet filtering code. iptables allows system operators to set up firewalls and IP masquerading, etc.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_iptables_installed
Identifiers and References

References:  - CM-6(a), SRG-OS-000480-GPOS-00227, 3.5.3.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_iptables
+            CM-6(a), SRG-OS-000480-GPOS-00227, 3.5.3.1.1

Complexity:low
Disruption:low
Strategy:enable

+DEBIAN_FRONTEND=noninteractive apt-get install -y "iptables"
+


+[[packages]]
+name = "iptables"
+version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_iptables
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_server.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_server.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_server.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 22.04 Level 2 Server Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level2_server

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Print Support
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server
    17. X Window System

Checklist

Group   Guide to the Secure Configuration of Ubuntu 22.04   Group contains 92 groups and 273 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -502,14 +502,7 @@
 
$ sudo apt remove gdm3
Rationale:
Unnecessary service packages must not be installed to decrease the attack surface of the system. A graphical environment is unnecessary for certain types of systems including a virtualization hypervisor.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_gdm_removed
Identifiers and References

References:  - CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10


Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
+            CM-7(a), CM-7(b), CM-6(a), SRG-OS-000480-GPOS-00227, 1.10

Complexity:low
Disruption:low
Strategy:disable
# Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
 # CAUTION: This remediation script will remove gdm
@@ -523,6 +516,13 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
+

Complexity:low
Disruption:low
Strategy:disable
include remove_gdm
+
+class remove_gdm {
+  package { 'gdm':
+    ensure => 'purged',
+  }
+}

Complexity:low
Disruption:low
Strategy:disable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -569,14 +569,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -584,10 +577,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -36785,14 +36785,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, 4.1.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "audit"
@@ -36800,10 +36793,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -36838,15 +36838,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -36857,9 +36849,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -37262,14 +37262,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -37277,10 +37270,17 @@
 else
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_workstation.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_workstation.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-cis_level2_workstation.html	2022-10-05 00:00:00.000000000 +0000
@@ -66,7 +66,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleCIS Ubuntu 22.04 Level 2 Workstation Benchmark
Profile IDxccdf_org.ssgproject.content_profile_cis_level2_workstation

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. GRUB2 bootloader configuration
    5. Configure Syslog
    6. Network Configuration and Firewalls
    7. File Permissions and Masks
  2. Services
    1. Avahi Server
    2. Cron and At Daemons
    3. Deprecated services
    4. DHCP
    5. DNS Server
    6. FTP Server
    7. Web Server
    8. IMAP and POP3 Server
    9. LDAP
    10. Network Time Protocol
    11. Obsolete Services
    12. Print Support
    13. Proxy Server
    14. Samba(SMB) Microsoft Windows File Sharing Server
    15. SNMP Server
    16. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 22.04   Group contains 92 groups and 275 rules
Group   @@ -110,14 +110,7 @@   [ref]
The aide package can be installed with the following command: 
 $ apt-get install aide
Rationale:
The AIDE package must be installed if it is to be available for integrity checking.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_aide_installed
Identifiers and References

References:  - BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000445-GPOS-00199, 1.4.1


Complexity:low
Disruption:low
Strategy:enable
include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "aide"
@@ -125,10 +118,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "aide"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure aide is installed
   package:
     name: aide
@@ -596,14 +596,7 @@
 limited root privileges to users and log root activity. The basic philosophy
 is to give as few privileges as possible but still allow system users to
 get their work done.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_sudo_installed
Identifiers and References

References:  - BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1


Complexity:low
Disruption:low
Strategy:enable
include install_sudo
-
-class install_sudo {
-  package { 'sudo':
-    ensure => 'installed',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, SRG-OS-000324-GPOS-00125, 1.3.1

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "sudo"
@@ -611,10 +604,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "sudo"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_sudo
+
+class install_sudo {
+  package { 'sudo':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure sudo is installed
   package:
     name: sudo
@@ -36981,14 +36981,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, 4.1.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "audit"
@@ -36996,10 +36989,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -37034,15 +37034,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -37053,9 +37045,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -37458,14 +37458,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -37473,10 +37466,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -37497,15 +37497,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
/usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-standard.html differs (HTML document, UTF-8 Unicode text, with very long lines)
--- old//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/doc/scap-security-guide/guides/ssg-ubuntu2204-guide-standard.html	2022-10-05 00:00:00.000000000 +0000
@@ -65,7 +65,7 @@
 other parties, and makes no guarantees, expressed or implied, about its
 quality, reliability, or any other characteristic.

Profile Information

Profile TitleStandard System Security Profile for Ubuntu 22.04
Profile IDxccdf_org.ssgproject.content_profile_standard

CPE Platforms

  • cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~

Revision History

Current version: 0.1.64

  • draft - (as of 2022-10-06) + (as of 2038-11-08)

Table of Contents

  1. System Settings
    1. Installing and Maintaining Software
    2. Account and Access Control
    3. System Accounting with auditd
    4. Configure Syslog
    5. File Permissions and Masks
  2. Services
    1. Apport Service
    2. Cron and At Daemons
    3. Deprecated services
    4. Network Time Protocol
    5. SSH Server

Checklist

Group   Guide to the Secure Configuration of Ubuntu 22.04   Group contains 22 groups and 45 rules
Group   @@ -257,14 +257,7 @@

Rule   Ensure the audit Subsystem is Installed   [ref]

The audit package should be installed.
Rationale:
The auditd service is an access monitoring and accounting daemon, watching system calls to audit any access, in comparison with potential local access control policy such as SELinux policy.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_audit_installed
Identifiers and References

References:  - BP28(R50), CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-002884, CCI-000169, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-7(a), AU-7(1), AU-7(2), AU-14, AU-12(2), AU-2(a), CM-6(a), FAU_GEN.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, 4.1.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_audit
-
-class install_audit {
-  package { 'audit':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "audit"
@@ -272,10 +265,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "audit"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_audit
+
+class install_audit {
+  package { 'audit':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure audit is installed
   package:
     name: audit
@@ -310,15 +310,7 @@
 Additionally, a properly configured audit subsystem ensures that actions of
 individual system users can be uniquely traced to those users so they
 can be held accountable for their actions.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_auditd_enabled
Identifiers and References

References:  - 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
-
-class enable_auditd {
-  service {'auditd':
-    enable => true,
-    ensure => 'running',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
+            1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.3.1, 3.3.2, 3.3.6, CCI-000126, CCI-000130, CCI-000131, CCI-000132, CCI-000133, CCI-000134, CCI-000135, CCI-000154, CCI-000158, CCI-000172, CCI-000366, CCI-001464, CCI-001487, CCI-001814, CCI-001875, CCI-001876, CCI-001877, CCI-002884, CCI-001878, CCI-001879, CCI-001880, CCI-001881, CCI-001882, CCI-001889, CCI-001914, CCI-000169, 164.308(a)(1)(ii)(D), 164.308(a)(5)(ii)(C), 164.310(a)(2)(iv), 164.310(d)(2)(iii), 164.312(b), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, CIP-004-6 R3.3, CIP-007-3 R6.5, AC-2(g), AU-3, AU-10, AU-2(d), AU-12(c), AU-14(1), AC-6(9), CM-6(a), SI-4(23), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1, Req-10.1, SRG-OS-000062-GPOS-00031, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000051-GPOS-00024, SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000254-GPOS-00095, SRG-OS-000255-GPOS-00096, SRG-OS-000337-GPOS-00129, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137, SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140, SRG-OS-000353-GPOS-00141, SRG-OS-000354-GPOS-00142, SRG-OS-000358-GPOS-00145, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000475-GPOS-00220, SRG-OS-000037-VMM-000150, SRG-OS-000063-VMM-000310, SRG-OS-000038-VMM-000160, SRG-OS-000039-VMM-000170, SRG-OS-000040-VMM-000180, SRG-OS-000041-VMM-000190, 4.1.1.2

Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; }; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -329,9 +321,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["auditd"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_auditd
+
+class enable_auditd {
+  service {'auditd':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Gather the package facts
   package_facts:
     manager: auto
@@ -595,14 +595,7 @@
                                 Ensure rsyslog is Installed
                                   [ref]
Rsyslog is installed by default. The rsyslog package can be installed with the following command: 
 $ apt-get install rsyslog
Rationale:
The rsyslog package provides the rsyslog daemon, which provides system logging services.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_package_rsyslog_installed
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1


Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
-
-class install_rsyslog {
-  package { 'rsyslog':
-    ensure => 'installed',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 DEBIAN_FRONTEND=noninteractive apt-get install -y "rsyslog"
@@ -610,10 +603,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [[packages]]
 name = "rsyslog"
 version = "*"
+

Complexity:low
Disruption:low
Strategy:enable
include install_rsyslog
+
+class install_rsyslog {
+  package { 'rsyslog':
+    ensure => 'installed',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Ensure rsyslog is installed
   package:
     name: rsyslog
@@ -634,15 +634,7 @@
 The rsyslog service can be enabled with the following command:
 
$ sudo systemctl enable rsyslog.service
Rationale:
The rsyslog service must be running in order to provide logging services, which are essential to system administration.
Severity: 
medium
Rule ID:xccdf_org.ssgproject.content_rule_service_rsyslog_enabled
Identifiers and References

References:  - BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2


Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
-
-class enable_rsyslog {
-  service {'rsyslog':
-    enable => true,
-    ensure => 'running',
-  }
-}
-


Complexity:low
Disruption:low
Strategy:enable
# Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
@@ -653,9 +645,17 @@
 else
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
-


+


 [customizations.services]
 enabled = ["rsyslog"]
+

Complexity:low
Disruption:low
Strategy:enable
include enable_rsyslog
+
+class enable_rsyslog {
+  service {'rsyslog':
+    enable => true,
+    ensure => 'running',
+  }
+}

Complexity:low
Disruption:low
Strategy:enable
- name: Enable service rsyslog
   block:
 
@@ -1750,29 +1750,7 @@
 
$ sudo systemctl mask --now apport.service
Rationale:
The Apport service modifies the kernel fs.suid_dumpable configuration at runtime which prevents other hardening from being persistent. Disabling the -service prevents this behavior.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_service_apport_disabled
Identifiers and References

Complexity:low
Disruption:medium
Reboot:true
Strategy:disable
apiVersion: machineconfiguration.openshift.io/v1
-kind: MachineConfig
-spec:
-  config:
-    ignition:
-      version: 3.1.0
-    systemd:
-      units:
-      - name: apport.service
-        enabled: false
-        mask: true
-      - name: apport.socket
-        enabled: false
-        mask: true
-

Complexity:low
Disruption:low
Strategy:enable
include disable_apport
-
-class disable_apport {
-  service {'apport':
-    enable => false,
-    ensure => 'stopped',
-  }
-}
-

Complexity:low
Disruption:low
Strategy:disable

+service prevents this behavior.
Severity: 
unknown
Rule ID:xccdf_org.ssgproject.content_rule_service_apport_disabled
Identifiers and References

Complexity:low
Disruption:low
Strategy:disable

 
 SYSTEMCTL_EXEC='/usr/bin/systemctl'
 "$SYSTEMCTL_EXEC" stop 'apport.service'
@@ -1787,10 +1765,18 @@
 # so let's reset the state so OVAL checks pass.
 # Service should be 'inactive', not 'failed' after reboot though.
 "$SYSTEMCTL_EXEC" reset-failed 'apport.service' || true
-


+


 [customizations.services]
 disabled = ["apport"]
-

Complexity:low
Disruption:low
Strategy:disable
- name: Disable service apport
+

Complexity:low
Disruption:low
Strategy:enable
include disable_apport
+
+class disable_apport {
+  service {'apport':
+    enable => false,
+    ensure => 'stopped',
+  }
/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -96,7 +96,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 16.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 16.04. It is a rendering of
@@ -139,14 +139,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -154,24 +149,24 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -179,9 +174,14 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -189,34 +189,34 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -3600,14 +3600,6 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
-              include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "gnutls-utils"
 
@@ -3616,6 +3608,14 @@
 name = "gnutls-utils"
 version = "*"
 
+              include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3647,14 +3647,6 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
-              include install_nss-tools
-
-class install_nss-tools {
-  package { 'nss-tools':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "nss-tools"
 
@@ -3663,6 +3655,14 @@
 name = "nss-tools"
 version = "*"
 
+              include install_nss-tools
+
+class install_nss-tools {
+  package { 'nss-tools':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -6784,14 +6784,6 @@
             CCI-001851
             SRG-OS-000342-GPOS-00133
             Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
-            include install_audispd-plugins
-
-class install_audispd-plugins {
-  package { 'audispd-plugins':
-    ensure => 'installed',
-  }
-}
-
             # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -98,7 +98,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 16.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 16.04. It is a rendering of
@@ -141,14 +141,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -156,24 +151,24 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -181,9 +176,14 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
           
         
         
@@ -191,34 +191,34 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
       
@@ -3602,14 +3602,6 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
-              include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "gnutls-utils"
 
@@ -3618,6 +3610,14 @@
 name = "gnutls-utils"
 version = "*"
 
+              include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3649,14 +3649,6 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
-              include install_nss-tools
-
-class install_nss-tools {
-  package { 'nss-tools':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "nss-tools"
 
@@ -3665,6 +3657,14 @@
 name = "nss-tools"
 version = "*"
 
+              include install_nss-tools
+
+class install_nss-tools {
+  package { 'nss-tools':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -6786,14 +6786,6 @@
             CCI-001851
             SRG-OS-000342-GPOS-00133
             Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
-            include install_audispd-plugins
-
-class install_audispd-plugins {
-  package { 'audispd-plugins':
-    ensure => 'installed',
-  }
-}
-
             # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -13,520 +13,514 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      The Installed Operating System Is FIPS 140-2 Certified
-      
-        ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1
-      
-    
-    
-      Configure auditd Disk Error Action on Disk Error
+    
+      Disable storing core dump
       
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
+    
+      Kernel panic on oops
       
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Set Password Maximum Age
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Verify Root Has A Primary GID 0
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_root_gid_zero_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Verify User Who Owns /var/log/syslog File
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-file_owner_var_log_syslog_action:testaction:1
       
     
-    
-      Sign kernel modules with SHA-512
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchown
       
-        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1
       
     
-    
-      Enable checks on credential management
+    
+      Enable syslog-ng Service
       
-        ocil:ssg-kernel_config_debug_credentials_action:testaction:1
+        ocil:ssg-service_syslogng_enabled_action:testaction:1
       
     
-    
-      Ensure /var/log/audit Located On Separate Partition
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchmod
       
-        ocil:ssg-partition_for_var_log_audit_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1
       
     
-    
-      Disable storing core dump
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-coredump_disable_storage_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Configure auditd Disk Full Action when Disk Space Is Full
+    
+      Don't target root user in the sudoers file
       
-        ocil:ssg-auditd_data_disk_full_action_action:testaction:1
+        ocil:ssg-sudoers_no_root_target_action:testaction:1
       
     
-    
-      Ensure the Default Umask is Set Correctly in login.defs
+    
+      Enable SLUB debugging support
       
-        ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1
+        ocil:ssg-kernel_config_slub_debug_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Set SSH Idle Timeout Interval
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-sshd_set_idle_timeout_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup gshadow File
+    
+      Add nosuid Option to /dev/shm
       
-        ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1
+        ocil:ssg-mount_option_dev_shm_nosuid_action:testaction:1
       
     
-    
-      Enable Encrypted X11 Forwarding
+    
+      Add nodev Option to /dev/shm
       
-        ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1
+        ocil:ssg-mount_option_dev_shm_nodev_action:testaction:1
       
     
-    
-      Ensure the Logon Failure Delay is Set Correctly in login.defs
+    
+      Disable SSH Support for Rhosts RSA Authentication
       
-        ocil:ssg-accounts_logon_fail_delay_action:testaction:1
+        ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1
       
/usr/share/xml/scap/ssg/content/ssg-ubuntu1604-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1604-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Ubuntu 16.04
   This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 16.04. It is a rendering of
@@ -43,14 +43,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
-      
-        
-      
-    
-    
+    
       
-        
+        
       
     
     
@@ -58,24 +53,24 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -83,9 +78,14 @@
         
       
     
-    
+    
       
-        
+        
+      
+    
+    
+      
+        
       
     
     
@@ -93,34 +93,34 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
   
@@ -3504,14 +3504,6 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
-          include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-
           
 DEBIAN_FRONTEND=noninteractive apt-get install -y "gnutls-utils"
 
@@ -3520,6 +3512,14 @@
 name = "gnutls-utils"
 version = "*"
 
+          include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}
+
           - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3551,14 +3551,6 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
-          include install_nss-tools
-
-class install_nss-tools {
-  package { 'nss-tools':
-    ensure => 'installed',
-  }
-}
-
           
 DEBIAN_FRONTEND=noninteractive apt-get install -y "nss-tools"
 
@@ -3567,6 +3559,14 @@
 name = "nss-tools"
 version = "*"
 
+          include install_nss-tools
+
+class install_nss-tools {
+  package { 'nss-tools':
+    ensure => 'installed',
+  }
+}
+
           - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -6688,14 +6688,6 @@
         CCI-001851
         SRG-OS-000342-GPOS-00133
         Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
-        include install_audispd-plugins
-
-class install_audispd-plugins {
-  package { 'audispd-plugins':
-    ensure => 'installed',
-  }
-}
-
         # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -6710,6 +6702,14 @@
/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -104,7 +104,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 18.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 18.04. It is a rendering of
@@ -147,15 +147,35 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -163,9 +183,9 @@
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -173,24 +193,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -198,20 +213,20 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -224,21 +239,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -3954,14 +3954,6 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
-              include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "gnutls-utils"
 
@@ -3970,6 +3962,14 @@
 name = "gnutls-utils"
 version = "*"
 
+              include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -4001,14 +4001,6 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
-              include install_nss-tools
-
-class install_nss-tools {
-  package { 'nss-tools':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "nss-tools"
 
@@ -4017,6 +4009,14 @@
 name = "nss-tools"
 version = "*"
 
+              include install_nss-tools
+
+class install_nss-tools {
+  package { 'nss-tools':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -104,7 +104,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 18.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 18.04. It is a rendering of
@@ -147,15 +147,35 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
+          
+        
         
           
             
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -163,9 +183,9 @@
             
           
         
-        
+        
           
-            
+            
           
         
         
@@ -173,24 +193,19 @@
             
           
         
-        
-          
-            
-          
-        
         
           
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -198,20 +213,20 @@
             
           
         
-        
+        
           
-            
-            
+            
           
         
-        
+        
           
-            
+            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -224,21 +239,6 @@
             
           
         
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
-        
-          
-            
-          
-        
       
       
       0.1.64
@@ -3954,14 +3954,6 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
-              include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "gnutls-utils"
 
@@ -3970,6 +3962,14 @@
 name = "gnutls-utils"
 version = "*"
 
+              include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -4001,14 +4001,6 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
-              include install_nss-tools
-
-class install_nss-tools {
-  package { 'nss-tools':
-    ensure => 'installed',
-  }
-}
-
               
 DEBIAN_FRONTEND=noninteractive apt-get install -y "nss-tools"
 
@@ -4017,6 +4009,14 @@
 name = "nss-tools"
 version = "*"
 
+              include install_nss-tools
+
+class install_nss-tools {
+  package { 'nss-tools':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure nss-tools is installed
   package:
     name: nss-tools
/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -13,154 +13,124 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      The Installed Operating System Is FIPS 140-2 Certified
-      
-        ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1
-      
-    
-    
-      Configure auditd Disk Error Action on Disk Error
-      
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
-      
-    
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
-      
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
-      
-    
-    
-      Ensure PAM Displays Last Logon/Access Notification
-      
-        ocil:ssg-display_login_attempts_action:testaction:1
-      
-    
-    
-      Ensure Logrotate Runs Periodically
-      
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
-      
-    
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Disable storing core dump
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Kernel panic on oops
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Add nosuid Option to /var/tmp
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-mount_option_var_tmp_nosuid_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Set Password Maximum Age
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      Sign kernel modules with SHA-512
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-kernel_config_module_sig_sha512_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Enable checks on credential management
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-kernel_config_debug_credentials_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Ensure /var/log/audit Located On Separate Partition
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-partition_for_var_log_audit_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
       
     
-    
-      Disable storing core dump
+    
+      Verify Root Has A Primary GID 0
       
-        ocil:ssg-coredump_disable_storage_action:testaction:1
+        ocil:ssg-accounts_root_gid_zero_action:testaction:1
       
     
-    
-      Configure auditd Disk Full Action when Disk Space Is Full
+    
+      Verify User Who Owns /var/log/syslog File
       
-        ocil:ssg-auditd_data_disk_full_action_action:testaction:1
+        ocil:ssg-file_owner_var_log_syslog_action:testaction:1
       
     
-    
-      Ensure the Default Umask is Set Correctly in login.defs
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchown
       
-        ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1
       
     
-    
-      Enable Use of Strict Mode Checking
+    
+      Enable syslog-ng Service
       
-        ocil:ssg-sshd_enable_strictmodes_action:testaction:1
+        ocil:ssg-service_syslogng_enabled_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup gshadow File
+    
+      Record Events that Modify the System's Discretionary Access Controls - fchmod
       
-        ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1
+        ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1
       
     
-    
-      Enable Encrypted X11 Forwarding
+    
+      Configure L1 Terminal Fault mitigations
       
-        ocil:ssg-sshd_enable_x11_forwarding_action:testaction:1
+        ocil:ssg-grub2_l1tf_argument_action:testaction:1
       
     
-    
-      Ensure the Logon Failure Delay is Set Correctly in login.defs
+    
+      Don't target root user in the sudoers file
       
-        ocil:ssg-accounts_logon_fail_delay_action:testaction:1
+        ocil:ssg-sudoers_no_root_target_action:testaction:1
       
     
-    
-      Verify Group Who Owns Backup shadow File
+    
+      Enable SLUB debugging support
       
-        ocil:ssg-file_owner_backup_etc_shadow_action:testaction:1
+        ocil:ssg-kernel_config_slub_debug_action:testaction:1
       
     
-    
-      Enable systemd_timesyncd Service
/usr/share/xml/scap/ssg/content/ssg-ubuntu1804-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu1804-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Ubuntu 18.04
   This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 18.04. It is a rendering of
@@ -43,15 +43,35 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
+    
+      
+        
+      
+    
+    
+      
+        
+      
+    
+    
+      
+        
+      
+    
+    
+      
+        
+      
+    
     
       
         
         
       
     
-    
+    
       
-        
+        
       
     
     
@@ -59,9 +79,9 @@
         
       
     
-    
+    
       
-        
+        
       
     
     
@@ -69,24 +89,19 @@
         
       
     
-    
-      
-        
-      
-    
     
       
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -94,20 +109,20 @@
         
       
     
-    
+    
       
-        
-        
+        
       
     
-    
+    
       
-        
+        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -120,21 +135,6 @@
         
       
     
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
-    
-      
-        
-      
-    
   
   
   0.1.64
@@ -3850,14 +3850,6 @@
 other required structures.
 This package contains command line TLS client and server and certificate
 manipulation tools.
-          include install_gnutls-utils
-
-class install_gnutls-utils {
-  package { 'gnutls-utils':
-    ensure => 'installed',
-  }
-}
-
           
 DEBIAN_FRONTEND=noninteractive apt-get install -y "gnutls-utils"
 
@@ -3866,6 +3858,14 @@
 name = "gnutls-utils"
 version = "*"
 
+          include install_gnutls-utils
+
+class install_gnutls-utils {
+  package { 'gnutls-utils':
+    ensure => 'installed',
+  }
+}
+
           - name: Ensure gnutls-utils is installed
   package:
     name: gnutls-utils
@@ -3897,14 +3897,6 @@
 server applications. Install the nss-tools package
 to install command-line tools to manipulate the NSS certificate
 and key database.
-          include install_nss-tools
-
-class install_nss-tools {
-  package { 'nss-tools':
-    ensure => 'installed',
-  }
-}
-
           
 DEBIAN_FRONTEND=noninteractive apt-get install -y "nss-tools"
 
@@ -3913,6 +3905,14 @@
 name = "nss-tools"
 version = "*"
 
+          include install_nss-tools
+
+class install_nss-tools {
+  package { 'nss-tools':
+    ensure => 'installed',
+  }
+}
+
           - name: Ensure nss-tools is installed
   package:
     name: nss-tools
@@ -7032,14 +7032,6 @@
/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -104,7 +104,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 20.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 20.04. It is a rendering of
@@ -147,14 +147,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -162,29 +157,30 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -192,29 +188,24 @@
             
           
         
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -222,15 +213,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
         
@@ -238,9 +228,19 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
           
         
       
@@ -3074,14 +3074,6 @@
                   UBTU-20-010450
                   1.4.1
                   The AIDE package must be installed if it is to be available for integrity checking.
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
                   # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -3096,6 +3088,14 @@
 name = "aide"
 version = "*"
 
+                  include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
+
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -4589,14 +4589,6 @@
               Unnecessary service packages must not be installed to decrease the attack surface of the system.
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
-              include remove_gdm3
-
-class remove_gdm3 {
-  package { 'gdm3':
-    ensure => 'purged',
-  }
-}
-
               # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
@@ -4612,6 +4604,14 @@
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
 
/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -104,7 +104,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 20.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 20.04. It is a rendering of
@@ -147,14 +147,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -162,29 +157,30 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -192,29 +188,24 @@
             
           
         
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -222,15 +213,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
         
@@ -238,9 +228,19 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
           
         
       
@@ -3074,14 +3074,6 @@
                   UBTU-20-010450
                   1.4.1
                   The AIDE package must be installed if it is to be available for integrity checking.
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
                   # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -3096,6 +3088,14 @@
 name = "aide"
 version = "*"
 
+                  include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
+
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -4589,14 +4589,6 @@
               Unnecessary service packages must not be installed to decrease the attack surface of the system.
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
-              include remove_gdm3
-
-class remove_gdm3 {
-  package { 'gdm3':
-    ensure => 'purged',
-  }
-}
-
               # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
@@ -4612,6 +4604,14 @@
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
 
/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -7,10 +7,10 @@
     2022-10-05T00:00:00
   
   
-    
-      Verify ownership of Message of the Day Banner
+    
+      Disable DCCP Support
       
-        ocil:ssg-file_owner_etc_motd_action:testaction:1
+        ocil:ssg-kernel_module_dccp_disabled_action:testaction:1
       
     
     
@@ -19,10 +19,10 @@
         ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1
       
     
-    
-      Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
+    
+      Verify that system commands directories are group owned by root
       
-        ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1
+        ocil:ssg-dir_groupownership_binary_dirs_action:testaction:1
       
     
     
@@ -31,1408 +31,1403 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      The Installed Operating System Is FIPS 140-2 Certified
-      
-        ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1
-      
-    
-    
-      Set Interactive Session Timeout
+    
+      Ensure All Files Are Owned by a User
       
-        ocil:ssg-accounts_tmout_action:testaction:1
+        ocil:ssg-no_files_unowned_by_user_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
+    
+      Install the opensc Package For Multifactor Authentication
       
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
+        ocil:ssg-package_opensc_installed_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
+    
+      Ensure auditd Collects Information on Kernel Module Unloading - delete_module
       
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1
       
     
-    
-      Ensure remote access methods are monitored in Rsyslog
+    
+      Record Any Attempts to Run ssh-agent
       
-        ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1
+        ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1
       
     
-    
-      Verify Group Who Owns /etc/cron.allow file
+    
+      Disable storing core dump
       
-        ocil:ssg-file_groupowner_cron_allow_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
+    
+      Kernel panic on oops
       
-        ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Verify /boot/grub/grub.cfg User Ownership
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-file_owner_grub2_cfg_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Configure a Sufficiently Large Partition for Audit Logs
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Record Unsuccessful Access Attempts to Files - creat
+    
+      Verify that audit tools Have Mode 0755 or less
       
-        ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1
+        ocil:ssg-file_permissions_audit_binaries_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Verify User Who Owns /etc/cron.allow file
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-file_owner_cron_allow_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Set Password Maximum Age
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Install the opensc Package For Multifactor Authentication
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-package_opensc_installed_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Disable Ctrl-Alt-Del Reboot Activation
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1
       
     
-    
-      Enforce usage of pam_wheel for su authentication
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-use_pam_wheel_for_su_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
/usr/share/xml/scap/ssg/content/ssg-ubuntu2004-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2004-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Ubuntu 20.04
   This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 20.04. It is a rendering of
@@ -43,14 +43,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
-      
-        
-      
-    
-    
+    
       
-        
+        
       
     
     
@@ -58,29 +53,30 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -88,29 +84,24 @@
         
       
     
-    
-      
-        
-      
-    
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -118,15 +109,14 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
-        
+    
+      
+        
       
     
     
@@ -134,9 +124,19 @@
         
       
     
-    
+    
       
-        
+        
+      
+    
+    
+      
+        
+      
+    
+    
+      
+        
       
     
   
@@ -2970,14 +2970,6 @@
               UBTU-20-010450
               1.4.1
               The AIDE package must be installed if it is to be available for integrity checking.
-              include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
               # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -2992,6 +2984,14 @@
 name = "aide"
 version = "*"
 
+              include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure aide is installed
   package:
     name: aide
@@ -4485,14 +4485,6 @@
           Unnecessary service packages must not be installed to decrease the attack surface of the system.
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
-          include remove_gdm3
-
-class remove_gdm3 {
-  package { 'gdm3':
-    ensure => 'purged',
-  }
-}
-
           # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
@@ -4508,6 +4500,14 @@
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
 
+          include remove_gdm3
/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds-1.2.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds-1.2.xml	2022-10-05 00:00:00.000000000 +0000
@@ -104,7 +104,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 22.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 22.04. It is a rendering of
@@ -147,14 +147,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -162,29 +157,30 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -192,29 +188,24 @@
             
           
         
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -222,15 +213,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
         
@@ -238,9 +228,19 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
           
         
       
@@ -2677,14 +2677,6 @@
                   SRG-OS-000445-GPOS-00199
                   1.4.1
                   The AIDE package must be installed if it is to be available for integrity checking.
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
                   # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -2699,6 +2691,14 @@
 name = "aide"
 version = "*"
 
+                  include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
+
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -4181,14 +4181,6 @@
               Unnecessary service packages must not be installed to decrease the attack surface of the system.
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
-              include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-
               # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
@@ -4204,6 +4196,14 @@
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
 
/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml	2022-10-05 00:00:00.000000000 +0000
@@ -104,7 +104,7 @@
   
   
     
-      draft
+      draft
       Guide to the Secure Configuration of Ubuntu 22.04
       This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 22.04. It is a rendering of
@@ -147,14 +147,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
       
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
         
@@ -162,29 +157,30 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
+        
+          
+            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -192,29 +188,24 @@
             
           
         
-        
-          
-            
-          
-        
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
-        
+        
           
-            
+            
           
         
         
@@ -222,15 +213,14 @@
             
           
         
-        
+        
           
-            
+            
           
         
-        
-          
-            
-            
+        
+          
+            
           
         
         
@@ -238,9 +228,19 @@
             
           
         
-        
+        
           
-            
+            
+          
+        
+        
+          
+            
+          
+        
+        
+          
+            
           
         
       
@@ -2677,14 +2677,6 @@
                   SRG-OS-000445-GPOS-00199
                   1.4.1
                   The AIDE package must be installed if it is to be available for integrity checking.
-                  include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
                   # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -2699,6 +2691,14 @@
 name = "aide"
 version = "*"
 
+                  include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
+
                   - name: Ensure aide is installed
   package:
     name: aide
@@ -4181,14 +4181,6 @@
               Unnecessary service packages must not be installed to decrease the attack surface of the system.
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
-              include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-
               # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
@@ -4204,6 +4196,14 @@
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
 
/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ocil.xml differs (XML 1.0 document, ASCII text)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ocil.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ocil.xml	2022-10-05 00:00:00.000000000 +0000
@@ -7,10 +7,10 @@
     2022-10-05T00:00:00
   
   
-    
-      Verify ownership of Message of the Day Banner
+    
+      Disable DCCP Support
       
-        ocil:ssg-file_owner_etc_motd_action:testaction:1
+        ocil:ssg-kernel_module_dccp_disabled_action:testaction:1
       
     
     
@@ -19,10 +19,10 @@
         ocil:ssg-audit_rules_unsuccessful_file_modification_open_by_handle_at_action:testaction:1
       
     
-    
-      Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
+    
+      Verify that system commands directories are group owned by root
       
-        ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1
+        ocil:ssg-dir_groupownership_binary_dirs_action:testaction:1
       
     
     
@@ -31,1408 +31,1403 @@
         ocil:ssg-file_owner_var_log_action:testaction:1
       
     
-    
-      The Installed Operating System Is FIPS 140-2 Certified
-      
-        ocil:ssg-installed_OS_is_FIPS_certified_action:testaction:1
-      
-    
-    
-      Set Interactive Session Timeout
+    
+      Ensure All Files Are Owned by a User
       
-        ocil:ssg-accounts_tmout_action:testaction:1
+        ocil:ssg-no_files_unowned_by_user_action:testaction:1
       
     
-    
-      Configure auditd Disk Error Action on Disk Error
+    
+      Install the opensc Package For Multifactor Authentication
       
-        ocil:ssg-auditd_data_disk_error_action_stig_action:testaction:1
+        ocil:ssg-package_opensc_installed_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - init
+    
+      Ensure auditd Collects Information on Kernel Module Unloading - delete_module
       
-        ocil:ssg-audit_privileged_commands_init_action:testaction:1
+        ocil:ssg-audit_rules_kernel_module_loading_delete_action:testaction:1
       
     
-    
-      Ensure remote access methods are monitored in Rsyslog
+    
+      Record Any Attempts to Run ssh-agent
       
-        ocil:ssg-rsyslog_remote_access_monitoring_action:testaction:1
+        ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1
       
     
-    
-      Verify Group Who Owns /etc/cron.allow file
+    
+      Disable storing core dump
       
-        ocil:ssg-file_groupowner_cron_allow_action:testaction:1
+        ocil:ssg-coredump_disable_storage_action:testaction:1
       
     
-    
-      Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
+    
+      Kernel panic on oops
       
-        ocil:ssg-audit_rules_privileged_commands_ssh_keysign_action:testaction:1
+        ocil:ssg-sysctl_kernel_panic_on_oops_action:testaction:1
       
     
-    
-      Ensure PAM Displays Last Logon/Access Notification
+    
+      Verify /boot/grub/grub.cfg User Ownership
       
-        ocil:ssg-display_login_attempts_action:testaction:1
+        ocil:ssg-file_owner_grub2_cfg_action:testaction:1
       
     
-    
-      Ensure Logrotate Runs Periodically
+    
+      Configure a Sufficiently Large Partition for Audit Logs
       
-        ocil:ssg-ensure_logrotate_activated_action:testaction:1
+        ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_action:testaction:1
       
     
-    
-      Configure Polyinstantiation of /var/tmp Directories
+    
+      Force kernel panic on uncorrected MCEs
       
-        ocil:ssg-accounts_polyinstantiated_var_tmp_action:testaction:1
+        ocil:ssg-grub2_mce_argument_action:testaction:1
       
     
-    
-      Verify iptables Enabled
+    
+      Disable SSH TCP Forwarding
       
-        ocil:ssg-service_iptables_enabled_action:testaction:1
+        ocil:ssg-sshd_disable_tcp_forwarding_action:testaction:1
       
     
-    
-      Record Unsuccessful Access Attempts to Files - creat
+    
+      Verify that audit tools Have Mode 0755 or less
       
-        ocil:ssg-audit_rules_unsuccessful_file_modification_creat_action:testaction:1
+        ocil:ssg-file_permissions_audit_binaries_action:testaction:1
       
     
-    
-      Verify User Who Owns shadow File
+    
+      Verify User Who Owns /etc/cron.allow file
       
-        ocil:ssg-file_owner_etc_shadow_action:testaction:1
+        ocil:ssg-file_owner_cron_allow_action:testaction:1
       
     
-    
-      Ensure Users Re-Authenticate for Privilege Escalation - sudo
+    
+      Set Password Maximum Age
       
-        ocil:ssg-sudo_require_authentication_action:testaction:1
+        ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1
       
     
-    
-      Ensure Sudo Logfile Exists - sudo logfile
+    
+      Enable checks on linked list manipulation
       
-        ocil:ssg-sudo_custom_logfile_action:testaction:1
+        ocil:ssg-kernel_config_debug_list_action:testaction:1
       
     
-    
-      A remote time server for Chrony is configured
+    
+      Ensure that Root's Path Does Not Include World or Group-Writable Directories
       
-        ocil:ssg-chronyd_specify_remote_server_action:testaction:1
+        ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1
       
     
-    
-      Install the opensc Package For Multifactor Authentication
+    
+      Ensure that System Accounts Are Locked
       
-        ocil:ssg-package_opensc_installed_action:testaction:1
+        ocil:ssg-no_password_auth_for_systemaccounts_action:testaction:1
       
     
-    
-      Ensure SSH MaxStartups is configured
+    
+      Disable Ctrl-Alt-Del Reboot Activation
       
-        ocil:ssg-sshd_set_maxstartups_action:testaction:1
+        ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1
       
     
-    
-      Enforce usage of pam_wheel for su authentication
+    
+      Verify Permissions on SSH Server Private *_key Key Files
       
-        ocil:ssg-use_pam_wheel_for_su_action:testaction:1
+        ocil:ssg-file_permissions_sshd_private_key_action:testaction:1
/usr/share/xml/scap/ssg/content/ssg-ubuntu2204-xccdf.xml differs (XML 1.0 document, ASCII text, with very long lines)
--- old//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
+++ new//usr/share/xml/scap/ssg/content/ssg-ubuntu2204-xccdf.xml	2022-10-05 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
 
 
-  draft
+  draft
   Guide to the Secure Configuration of Ubuntu 22.04
   This guide presents a catalog of security-relevant
 configuration settings for Ubuntu 22.04. It is a rendering of
@@ -43,14 +43,9 @@
 countries. All other names are registered trademarks or trademarks of their
 respective companies.
   
-    
-      
-        
-      
-    
-    
+    
       
-        
+        
       
     
     
@@ -58,29 +53,30 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
+    
+      
+        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -88,29 +84,24 @@
         
       
     
-    
-      
-        
-      
-    
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
-    
+    
       
-        
+        
       
     
     
@@ -118,15 +109,14 @@
         
       
     
-    
+    
       
-        
+        
       
     
-    
-      
-        
-        
+    
+      
+        
       
     
     
@@ -134,9 +124,19 @@
         
       
     
-    
+    
       
-        
+        
+      
+    
+    
+      
+        
+      
+    
+    
+      
+        
       
     
   
@@ -2573,14 +2573,6 @@
               SRG-OS-000445-GPOS-00199
               1.4.1
               The AIDE package must be installed if it is to be available for integrity checking.
-              include install_aide
-
-class install_aide {
-  package { 'aide':
-    ensure => 'installed',
-  }
-}
-
               # Remediation is applicable only in certain platforms
 if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
@@ -2595,6 +2587,14 @@
 name = "aide"
 version = "*"
 
+              include install_aide
+
+class install_aide {
+  package { 'aide':
+    ensure => 'installed',
+  }
+}
+
               - name: Ensure aide is installed
   package:
     name: aide
@@ -4077,14 +4077,6 @@
           Unnecessary service packages must not be installed to decrease the attack surface of the system.
 A graphical environment is unnecessary for certain types of systems including a virtualization
 hypervisor.
-          include remove_gdm
-
-class remove_gdm {
-  package { 'gdm':
-    ensure => 'purged',
-  }
-}
-
           # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}\n' 'gdm3' 2>/dev/null | grep -q installed; then
 
@@ -4100,6 +4092,14 @@
     >&2 echo 'Remediation is not applicable, nothing was done'
 fi
 
+          include remove_gdm
overalldiffered=4 (number of pkgs that are not bit-by-bit identical: 0 is good)
overall=1