diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index e0b5a9530bcc..8c0d9c253a62 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -1,8 +1,7 @@ ---- -policy: 'DRAFT - CIS Benchmark for Red Hat Enterprise Linux 10' -title: 'DRAFT - CIS Benchmark for Red Hat Enterprise Linux 10' +policy: CIS Benchmark for Red Hat Enterprise Linux 10 +title: CIS Benchmark for Red Hat Enterprise Linux 10 id: cis_rhel10 -version: 'Draft' +version: 1.0 source: https://www.cisecurity.org/cis-benchmarks/#red_hat_linux levels: @@ -19,6 +18,7 @@ reference_type: cis product: rhel10 controls: + - id: reload_dconf_db title: Reload Dconf database levels: @@ -30,7 +30,61 @@ controls: rules: - dconf_db_up_to_date + - id: 1.1.1.1 + title: Ensure cramfs kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_cramfs_disabled + + - id: 1.1.1.2 + title: Ensure freevxfs kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_freevxfs_disabled + + - id: 1.1.1.3 + title: Ensure hfs kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_hfs_disabled + + - id: 1.1.1.4 + title: Ensure hfsplus kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_hfsplus_disabled + + - id: 1.1.1.5 + title: Ensure jffs2 kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_jffs2_disabled + - id: 1.1.1.6 + title: Ensure overlay kernel module is not available (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - kernel_module_overlayfs_disabled + + - id: 1.1.1.7 title: Ensure squashfs kernel module is not available (Automated) levels: - l2_server @@ -39,7 +93,7 @@ controls: rules: - kernel_module_squashfs_disabled - - id: 1.1.1.7 + - id: 1.1.1.8 title: Ensure udf kernel module is not available (Automated) levels: - l2_server @@ -48,7 +102,16 @@ controls: rules: - kernel_module_udf_disabled - - id: 1.1.1.8 + - id: 1.1.1.9 + title: Ensure firewire-core kernel module is not available (Automated) + levels: + - l1_server + - l2_workstation + status: automated + rules: + - kernel_module_firewire-core_disabled + + - id: 1.1.1.10 title: Ensure usb-storage kernel module is not available (Automated) levels: - l1_server @@ -57,15 +120,15 @@ controls: rules: - kernel_module_usb-storage_disabled - - id: 1.1.1.9 + - id: 1.1.1.11 title: Ensure unused filesystems kernel modules are not available (Manual) levels: - l1_server - - l2_workstation + - l1_workstation status: manual - id: 1.1.2.1.1 - title: Ensure /tmp is a separate partition (Automated) + title: Ensure /tmp is tmpfs or a separate partition (Automated) levels: - l1_server - l1_workstation @@ -101,7 +164,7 @@ controls: - mount_option_tmp_noexec - id: 1.1.2.2.1 - title: Ensure /dev/shm is a separate partition (Automated) + title: Ensure /dev/shm is tmpfs or a separate partition (Automated) levels: - l1_server - l1_workstation @@ -308,7 +371,7 @@ controls: - ensure_redhat_gpgkey_installed - id: 1.2.1.2 - title: Ensure gpgcheck is globally activated (Automated) + title: Ensure gpgcheck is configured (Automated) levels: - l1_server - l1_workstation @@ -330,6 +393,13 @@ controls: - l1_workstation status: manual + - id: 1.2.1.5 + title: Ensure weak dependencies are configured (Automated) + levels: + - l2_server + - l2_workstation + status: automated + - id: 1.2.2.1 title: Ensure updates, patches, and additional security software are installed (Manual) levels: @@ -428,8 +498,7 @@ controls: - l1_server - l1_workstation status: pending - notes: |- - This requirement demands a deeper review of the rules. + notes: This requirement demands a deeper review of the rules. rules: - file_groupowner_grub2_cfg - file_owner_grub2_cfg @@ -439,113 +508,145 @@ controls: - file_permissions_user_cfg - id: 1.5.1 - title: Ensure address space layout randomization is enabled (Automated) + title: Ensure core file size is configured (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - Address Space Layout Randomization (ASLR) rules: - - sysctl_kernel_randomize_va_space + - disable_users_coredumps - id: 1.5.2 - title: Ensure ptrace_scope is restricted (Automated) + title: Ensure fs.protected_hardlinks is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - sysctl_kernel_yama_ptrace_scope + - sysctl_fs_protected_hardlinks - id: 1.5.3 - title: Ensure core dump backtraces are disabled (Automated) + title: Ensure fs.protected_symlinks is configured (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - sysctl_fs_protected_symlinks + + - id: 1.5.4 + title: Ensure fs.suid_dumpable is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - coredump_disable_backtraces + - sysctl_fs_suid_dumpable - - id: 1.5.4 - title: Ensure core dump storage is disabled (Automated) + - id: 1.5.5 + title: Ensure kernel.dmesg_restrict is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - coredump_disable_storage + - sysctl_kernel_dmesg_restrict - - id: 1.6.1 - title: Ensure system wide crypto policy is not set to legacy (Automated) + - id: 1.5.6 + title: Ensure kernel.kptr_restrict is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - configure_crypto_policy - - var_system_crypto_policy=default_policy + - sysctl_kernel_kptr_restrict - - id: 1.6.2 - title: Ensure system wide crypto policy is not set in sshd configuration (Automated) + - id: 1.5.7 + title: Ensure kernel.yama.ptrace_scope is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - configure_ssh_crypto_policy + - sysctl_kernel_yama_ptrace_scope - - id: 1.6.3 - title: Ensure system wide crypto policy disables sha1 hash and signature support (Automated) + - id: 1.5.8 + title: Ensure kernel.randomize_va_space is configured (Automated) levels: - l1_server - l1_workstation status: automated notes: |- - This requirement is already satisfied by 1.6.1. - related_rules: - - configure_crypto_policy + Address Space Layout Randomization (ASLR) + rules: + - sysctl_kernel_randomize_va_space - - id: 1.6.4 - title: Ensure system wide crypto policy disables macs less than 128 bits (Automated) + - id: 1.5.9 + title: Ensure systemd-coredump ProcessSizeMax is configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure a module disabling weak MACs in - /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. - related_rules: + status: automated + rules: + - coredump_disable_backtraces + + - id: 1.5.10 + title: Ensure systemd-coredump Storage is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - coredump_disable_storage + + - id: 1.6.1 + title: Ensure system wide crypto policy is not set to legacy (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - configure_crypto_policy + - var_system_crypto_policy=default_policy - - id: 1.6.5 - title: Ensure system wide crypto policy disables cbc for ssh (Automated) + - id: 1.6.2 + title: Ensure system wide crypto policy disables sha1 hash and signature support (Automated) levels: - l1_server - l1_workstation - status: pending + status: manual notes: |- - It is necessary a new rule to ensure a module disabling CBC in + It is necessary a new rule to ensure a module disabling sha1 in /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. related_rules: - configure_crypto_policy - - id: 1.6.6 - title: Ensure system wide crypto policy disables chacha20-poly1305 for ssh (Automated) + - id: 1.6.3 + title: Ensure system wide crypto policy macs are configured (Automated) levels: - l1_server - l1_workstation status: manual + notes: |- + It is necessary a new rule to ensure a module disabling weak MACs in + /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. + related_rules: + - configure_crypto_policy - - id: 1.6.7 - title: Ensure system wide crypto policy disables EtM for ssh (Automated) + - id: 1.6.4 + title: Ensure system wide crypto policy disables cbc for ssh (Automated) levels: - l1_server - l1_workstation status: manual + notes: |- + It is necessary a new rule to ensure a module disabling CBC in + /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. + related_rules: + - configure_crypto_policy - id: 1.7.1 - title: Ensure message of the day is configured properly (Automated) + title: Ensure /etc/motd is configured (Automated) levels: - l1_server - l1_workstation @@ -555,7 +656,7 @@ controls: - cis_banner_text=cis - id: 1.7.2 - title: Ensure local login warning banner is configured properly (Automated) + title: Ensure /etc/issue is configured (Automated) levels: - l1_server - l1_workstation @@ -565,7 +666,7 @@ controls: - cis_banner_text=cis - id: 1.7.3 - title: Ensure remote login warning banner is configured properly (Automated) + title: Ensure /etc/issue.net is configured (Automated) levels: - l1_server - l1_workstation @@ -608,14 +709,6 @@ controls: - file_permissions_etc_issue_net - id: 1.8.1 - title: Ensure GNOME Display Manager is removed (Automated) - levels: - - l2_server - status: automated - rules: - - package_gdm_removed - - - id: 1.8.2 title: Ensure GDM login banner is configured (Automated) levels: - l1_server @@ -626,8 +719,8 @@ controls: - dconf_gnome_login_banner_text - login_banner_text=cis_banners - - id: 1.8.3 - title: Ensure GDM disable-user-list option is enabled (Automated) + - id: 1.8.2 + title: Ensure GDM disable-user-list is configured (Automated) levels: - l1_server - l1_workstation @@ -635,8 +728,8 @@ controls: rules: - dconf_gnome_disable_user_list - - id: 1.8.4 - title: Ensure GDM screen locks when the user is idle (Automated) + - id: 1.8.3 + title: Ensure GDM screen lock is configured (Automated) levels: - l1_server - l1_workstation @@ -644,31 +737,13 @@ controls: rules: - dconf_gnome_screensaver_idle_delay - dconf_gnome_screensaver_lock_delay - - inactivity_timeout_value=15_minutes - - var_screensaver_lock_delay=5_seconds - - - id: 1.8.5 - title: Ensure GDM screen locks cannot be overridden (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - dconf_gnome_session_idle_user_locks - dconf_gnome_screensaver_user_locks + - inactivity_timeout_value=15_minutes + - var_screensaver_lock_delay=5_seconds - - id: 1.8.6 - title: Ensure GDM automatic mounting of removable media is disabled (Automated) - levels: - - l1_server - - l2_workstation - status: automated - rules: - - dconf_gnome_disable_automount - - dconf_gnome_disable_automount_open - - - id: 1.8.7 - title: Ensure GDM disabling automatic mounting of removable media is not overridden (Automated) + - id: 1.8.4 + title: Ensure GDM automount is configured (Automated) levels: - l1_server - l2_workstation @@ -677,17 +752,8 @@ controls: - dconf_gnome_disable_automount - dconf_gnome_disable_automount_open - - id: 1.8.8 - title: Ensure GDM autorun-never is enabled (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - dconf_gnome_disable_autorun - - - id: 1.8.9 - title: Ensure GDM autorun-never is not overridden (Automated) + - id: 1.8.5 + title: Ensure GDM autorun-never is configured (Automated) levels: - l1_server - l1_workstation @@ -695,18 +761,12 @@ controls: rules: - dconf_gnome_disable_autorun - - id: 1.8.10 - title: Ensure XDMCP is not enabled (Automated) - notes: |- - This was inherited from the RHEL 9 profile. - However, it was reported that XDMCP is no - longer in RHEL 10. + - id: 1.8.6 + title: Ensure Xwayland is configured (Automated) levels: - - l1_server - - l1_workstation - status: automated - related_rules: - - gnome_gdm_disable_xdmcp + - l2_server + - l2_workstation + status: pending - id: 2.1.1 title: Ensure autofs services are not in use (Automated) @@ -729,6 +789,15 @@ controls: - package_avahi_removed - id: 2.1.3 + title: Ensure cockpit web services are not in use (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - service_cockpit_disabled + + - id: 2.1.4 title: Ensure dhcp server services are not in use (Automated) levels: - l1_server @@ -739,7 +808,7 @@ controls: related_rules: - service_dhcpd_disabled - - id: 2.1.4 + - id: 2.1.5 title: Ensure dns server services are not in use (Automated) levels: - l1_server @@ -750,7 +819,7 @@ controls: related_rules: - service_named_disabled - - id: 2.1.5 + - id: 2.1.6 title: Ensure dnsmasq services are not in use (Automated) levels: - l1_server @@ -759,17 +828,6 @@ controls: rules: - package_dnsmasq_removed - - id: 2.1.6 - title: Ensure samba file server services are not in use (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - package_samba_removed - related_rules: - - service_smb_disabled - - id: 2.1.7 title: Ensure ftp server services are not in use (Automated) levels: @@ -792,7 +850,6 @@ controls: - package_cyrus-imapd_removed related_rules: - service_dovecot_disabled - # new rule would be nice to disable cyrus-imapd service - id: 2.1.9 title: Ensure network file system services are not in use (Automated) @@ -809,16 +866,6 @@ controls: - package_nfs-utils_removed - id: 2.1.10 - title: Ensure nis server services are not in use (Automated) - levels: - - l1_server - - l1_workstation - status: automated - related_rules: - - service_ypserv_disabled - - package_ypserv_removed - - - id: 2.1.11 title: Ensure print server services are not in use (Automated) levels: - l1_server @@ -828,7 +875,7 @@ controls: related_rules: - package_cups_removed - - id: 2.1.12 + - id: 2.1.11 title: Ensure rpcbind services are not in use (Automated) levels: - l1_server @@ -842,7 +889,7 @@ controls: related_rules: - package_rpcbind_removed - - id: 2.1.13 + - id: 2.1.12 title: Ensure rsync services are not in use (Automated) levels: - l1_server @@ -853,6 +900,17 @@ controls: related_rules: - service_rsyncd_disabled + - id: 2.1.13 + title: Ensure samba file server services are not in use (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - package_samba_removed + related_rules: + - service_smb_disabled + - id: 2.1.14 title: Ensure snmp services are not in use (Automated) levels: @@ -908,7 +966,14 @@ controls: - package_nginx_removed related_rules: - service_httpd_disabled - # rule would be nice to disable nginx service + + - id: 2.1.19 + title: Ensure GNOME Display Manager is removed (Automated) + levels: + - l2_server + status: automated + rules: + - package_gdm_removed - id: 2.1.20 title: Ensure X window server services are not in use (Automated) @@ -962,15 +1027,6 @@ controls: - package_openldap-clients_removed - id: 2.2.3 - title: Ensure nis client is not installed (Automated) - levels: - - l1_server - - l1_workstation - status: automated - related_rules: - - package_ypbind_removed - - - id: 2.2.4 title: Ensure telnet client is not installed (Automated) levels: - l1_server @@ -979,7 +1035,7 @@ controls: rules: - package_telnet_removed - - id: 2.2.5 + - id: 2.2.4 title: Ensure tftp client is not installed (Automated) levels: - l1_server @@ -1027,7 +1083,7 @@ controls: - service_crond_enabled - id: 2.4.1.2 - title: Ensure permissions on /etc/crontab are configured (Automated) + title: Ensure access to /etc/crontab is configured (Automated) levels: - l1_server - l1_workstation @@ -1038,7 +1094,7 @@ controls: - file_permissions_crontab - id: 2.4.1.3 - title: Ensure permissions on /etc/cron.hourly are configured (Automated) + title: Ensure access to /etc/cron.hourly is configured (Automated) levels: - l1_server - l1_workstation @@ -1049,7 +1105,7 @@ controls: - file_permissions_cron_hourly - id: 2.4.1.4 - title: Ensure permissions on /etc/cron.daily are configured (Automated) + title: Ensure access to /etc/cron.daily is configured (Automated) levels: - l1_server - l1_workstation @@ -1060,7 +1116,7 @@ controls: - file_permissions_cron_daily - id: 2.4.1.5 - title: Ensure permissions on /etc/cron.weekly are configured (Automated) + title: Ensure access to /etc/cron.weekly is configured (Automated) levels: - l1_server - l1_workstation @@ -1071,7 +1127,7 @@ controls: - file_permissions_cron_weekly - id: 2.4.1.6 - title: Ensure permissions on /etc/cron.monthly are configured (Automated) + title: Ensure access to /etc/cron.monthly is configured (Automated) levels: - l1_server - l1_workstation @@ -1082,7 +1138,14 @@ controls: - file_permissions_cron_monthly - id: 2.4.1.7 - title: Ensure permissions on /etc/cron.d are configured (Automated) + title: Ensure access to /etc/cron.yearly is configured (Automated) + levels: + - l1_server + - l1_workstation + status: pending + + - id: 2.4.1.8 + title: Ensure access to /etc/cron.d is configured (Automated) levels: - l1_server - l1_workstation @@ -1092,8 +1155,8 @@ controls: - file_owner_cron_d - file_permissions_cron_d - - id: 2.4.1.8 - title: Ensure crontab is restricted to authorized users (Automated) + - id: 2.4.1.9 + title: Ensure access to crontab is configured (Automated) levels: - l1_server - l1_workstation @@ -1106,7 +1169,7 @@ controls: - file_permissions_cron_allow - id: 2.4.2.1 - title: Ensure at is restricted to authorized users (Automated) + title: Ensure access to at is configured (Automated) levels: - l1_server - l1_workstation @@ -1128,7 +1191,7 @@ controls: status: manual - id: 3.1.2 - title: Ensure wireless interfaces are disabled (Automated) + title: Ensure wireless interfaces are not available (Automated) levels: - l1_server status: automated @@ -1144,47 +1207,105 @@ controls: rules: - service_bluetooth_disabled - - id: 3.2.2 - title: Ensure tipc kernel module is not available (Automated) + - id: 3.2.1 + title: Ensure atm kernel module is not available (Automated) levels: - - l2_server - - l2_workstation + - l1_server + - l1_workstation status: automated rules: - - kernel_module_tipc_disabled + - kernel_module_atm_disabled - - id: 3.2.4 - title: Ensure sctp kernel module is not available (Automated) + - id: 3.2.2 + title: Ensure can kernel module is not available (Automated) levels: - - l2_server - - l2_workstation + - l1_server + - l1_workstation status: automated rules: - - kernel_module_sctp_disabled + - kernel_module_can_disabled + + - id: 3.2.3 + title: Ensure dccp kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_dccp_disabled + + - id: 3.2.4 + title: Ensure tipc kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_tipc_disabled - - id: 3.3.1 - title: Ensure IP forwarding is disabled (Automated) + - id: 3.2.5 + title: Ensure rds kernel module is not available (Automated) levels: - l1_server - l1_workstation status: automated + rules: + - kernel_module_rds_disabled + + - id: 3.2.6 + title: Ensure sctp kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_sctp_disabled + + - id: 3.3.1.1 + title: Ensure net.ipv4.ip_forward is configured (Automated) + levels: + - l1_workstation + - l2_server + status: automated rules: - sysctl_net_ipv4_ip_forward - - sysctl_net_ipv6_conf_all_forwarding - - sysctl_net_ipv6_conf_all_forwarding_value=disabled - - id: 3.3.2 - title: Ensure packet redirect sending is disabled (Automated) + - id: 3.3.1.2 + title: Ensure net.ipv4.conf.all.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv4_conf_all_forwarding + + - id: 3.3.1.3 + title: Ensure net.ipv4.conf.default.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: pending + + - id: 3.3.1.4 + title: Ensure net.ipv4.conf.all.send_redirects is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - sysctl_net_ipv4_conf_all_send_redirects + + - id: 3.3.1.5 + title: Ensure net.ipv4.conf.default.send_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_send_redirects - - id: 3.3.3 - title: Ensure bogus icmp responses are ignored (Automated) + - id: 3.3.1.6 + title: Ensure net.ipv4.icmp_ignore_bogus_error_responses is configured (Automated) levels: - l1_server - l1_workstation @@ -1193,8 +1314,8 @@ controls: - sysctl_net_ipv4_icmp_ignore_bogus_error_responses - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled - - id: 3.3.4 - title: Ensure broadcast icmp requests are ignored (Automated) + - id: 3.3.1.7 + title: Ensure net.ipv4.icmp_echo_ignore_broadcasts is configured (Automated) levels: - l1_server - l1_workstation @@ -1203,8 +1324,8 @@ controls: - sysctl_net_ipv4_icmp_echo_ignore_broadcasts - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled - - id: 3.3.5 - title: Ensure icmp redirects are not accepted (Automated) + - id: 3.3.1.8 + title: Ensure net.ipv4.conf.all.accept_redirects is configured (Automated) levels: - l1_server - l1_workstation @@ -1212,15 +1333,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_accept_redirects - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled + + - id: 3.3.1.9 + title: Ensure net.ipv4.conf.default.accept_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_accept_redirects - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled - - sysctl_net_ipv6_conf_all_accept_redirects - - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled - - sysctl_net_ipv6_conf_default_accept_redirects - - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled - - id: 3.3.6 - title: Ensure secure icmp redirects are not accepted (Automated) + - id: 3.3.1.10 + title: Ensure net.ipv4.conf.all.secure_redirects is configured (Automated) levels: - l1_server - l1_workstation @@ -1228,11 +1353,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_secure_redirects - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled + + - id: 3.3.1.11 + title: Ensure net.ipv4.conf.default.secure_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_secure_redirects - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled - - id: 3.3.7 - title: Ensure reverse path filtering is enabled (Automated) + - id: 3.3.1.12 + title: Ensure net.ipv4.conf.all.rp_filter is configured (Automated) levels: - l1_server - l1_workstation @@ -1240,11 +1373,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_rp_filter - sysctl_net_ipv4_conf_all_rp_filter_value=enabled + + - id: 3.3.1.13 + title: Ensure net.ipv4.conf.default.rp_filter is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_rp_filter - sysctl_net_ipv4_conf_default_rp_filter_value=enabled - - id: 3.3.8 - title: Ensure source routed packets are not accepted (Automated) + - id: 3.3.1.14 + title: Ensure net.ipv4.conf.all.accept_source_route is configured (Automated) levels: - l1_server - l1_workstation @@ -1252,15 +1393,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_accept_source_route - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled + + - id: 3.3.1.15 + title: Ensure net.ipv4.conf.default.accept_source_route is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_accept_source_route - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled - - sysctl_net_ipv6_conf_all_accept_source_route - - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled - - sysctl_net_ipv6_conf_default_accept_source_route - - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled - - id: 3.3.9 - title: Ensure suspicious packets are logged (Automated) + - id: 3.3.1.16 + title: Ensure net.ipv4.conf.all.log_martians is configured (Automated) levels: - l1_server - l1_workstation @@ -1268,11 +1413,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_log_martians - sysctl_net_ipv4_conf_all_log_martians_value=enabled + + - id: 3.3.1.17 + title: Ensure net.ipv4.conf.default.log_martians is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_log_martians - sysctl_net_ipv4_conf_default_log_martians_value=enabled - - id: 3.3.10 - title: Ensure tcp syn cookies is enabled (Automated) + - id: 3.3.1.18 + title: Ensure net.ipv4.tcp_syncookies is configured (Automated) levels: - l1_server - l1_workstation @@ -1281,8 +1434,68 @@ controls: - sysctl_net_ipv4_tcp_syncookies - sysctl_net_ipv4_tcp_syncookies_value=enabled - - id: 3.3.11 - title: Ensure IPv6 router advertisements are not accepted (Automated) + - id: 3.3.2.1 + title: Ensure net.ipv6.conf.all.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv6_conf_all_forwarding + - sysctl_net_ipv6_conf_all_forwarding_value=disabled + + - id: 3.3.2.2 + title: Ensure net.ipv6.conf.default.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv6_conf_default_forwarding + - sysctl_net_ipv6_conf_default_forwarding_value=disabled + + - id: 3.3.2.3 + title: Ensure net.ipv6.conf.all.accept_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv6_conf_all_accept_redirects + - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled + + - id: 3.3.2.4 + title: Ensure net.ipv6.conf.default.accept_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv6_conf_default_accept_redirects + - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled + + - id: 3.3.2.5 + title: Ensure net.ipv6.conf.all.accept_source_route is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv6_conf_all_accept_source_route + - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled + + - id: 3.3.2.6 + title: Ensure net.ipv6.conf.default.accept_source_route is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv6_conf_default_accept_source_route + - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled + + - id: 3.3.2.7 + title: Ensure net.ipv6.conf.all.accept_ra is configured (Automated) levels: - l1_server - l1_workstation @@ -1290,103 +1503,77 @@ controls: rules: - sysctl_net_ipv6_conf_all_accept_ra - sysctl_net_ipv6_conf_all_accept_ra_value=disabled - - sysctl_net_ipv6_conf_default_accept_ra - - sysctl_net_ipv6_conf_default_accept_ra_value=disabled - - id: 4.1.1 - title: Ensure nftables is installed (Automated) + - id: 3.3.2.8 + title: Ensure net.ipv6.conf.default.accept_ra is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - package_nftables_installed + - sysctl_net_ipv6_conf_default_accept_ra + - sysctl_net_ipv6_conf_default_accept_ra_value=disabled - - id: 4.1.2 - title: Ensure a single firewall configuration utility is in use (Automated) + - id: 4.1.1 + title: Ensure firewalld is installed (Automated) levels: - l1_server - l1_workstation status: automated rules: - - service_firewalld_enabled - package_firewalld_installed - - service_nftables_disabled - - id: 4.2.1 - title: Ensure firewalld drops unnecessary services and ports (Manual) + - id: 4.1.2 + title: Ensure firewalld backend is configured (Automated) levels: - l1_server - l1_workstation - status: manual - related_rules: - - configure_firewalld_ports + status: pending - - id: 4.2.2 - title: Ensure firewalld loopback traffic is configured (Automated) + - id: 4.1.3 + title: Ensure firewalld.service is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - firewalld_loopback_traffic_trusted - - firewalld_loopback_traffic_restricted + - service_firewalld_enabled - - id: 4.3.1 - title: Ensure nftables base chains exist (Automated) + - id: 4.1.4 + title: Ensure firewalld active zone target is configured (Automated) levels: - l1_server - l1_workstation - status: supported - notes: |- - RHEL systems use firewalld for firewall management. Although nftables is the default - back-end for firewalld, it is not recommended to use nftables directly when firewalld - is in use. When using firewalld the base chains are installed by default. - related_rules: - - set_nftables_base_chain - - var_nftables_table=firewalld - - var_nftables_family=inet - - var_nftables_base_chain_names=chain_names - - var_nftables_base_chain_types=chain_types - - var_nftables_base_chain_hooks=chain_hooks - - var_nftables_base_chain_priorities=chain_priorities - - var_nftables_base_chain_policies=chain_policies + status: pending - - id: 4.3.2 - title: Ensure nftables established connections are configured (Manual) + - id: 4.1.5 + title: Ensure firewalld loopback traffic is configured (Automated) levels: - l1_server - l1_workstation - status: manual + status: supported + rules: + - firewalld_loopback_traffic_trusted + - firewalld_loopback_traffic_restricted - - id: 4.3.3 - title: Ensure nftables default deny firewall policy (Automated) + - id: 4.1.6 + title: Ensure firewalld loopback source address traffic is configured (Manual) levels: - l1_server - l1_workstation - status: supported - notes: |- - RHEL systems use firewalld for firewall management. Although nftables is the default - back-end for firewalld, it is not recommended to use nftables directly when firewalld - is in use. - related_rules: - - nftables_ensure_default_deny_policy + status: manual - - id: 4.3.4 - title: Ensure nftables loopback traffic is configured (Automated) + - id: 4.1.7 + title: Ensure firewalld services and ports are configured (Manual) levels: - l1_server - l1_workstation - status: supported - notes: |- - RHEL systems use firewalld for firewall management. Although nftables is the default - back-end for firewalld, it is not recommended to use nftables directly when firewalld - is in use. + status: manual related_rules: - - set_nftables_loopback_traffic + - configure_firewalld_ports - id: 5.1.1 - title: Ensure permissions on /etc/ssh/sshd_config are configured (Automated) + title: Ensure access to /etc/ssh/sshd_config is configured (Automated) levels: - l1_server - l1_workstation @@ -1397,87 +1584,61 @@ controls: - file_permissions_sshd_config - id: 5.1.2 - title: Ensure permissions on SSH private host key files are configured (Automated) + title: Ensure access to SSH private host key files is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - file_permissions_sshd_private_key - - file_ownership_sshd_private_key - file_groupownership_sshd_private_key + - file_ownership_sshd_private_key + - file_permissions_sshd_private_key - id: 5.1.3 - title: Ensure permissions on SSH public host key files are configured (Automated) + title: Ensure access to SSH public host key files is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - file_permissions_sshd_pub_key - - file_ownership_sshd_pub_key - file_groupownership_sshd_pub_key + - file_ownership_sshd_pub_key + - file_permissions_sshd_pub_key - id: 5.1.4 - title: Ensure sshd Ciphers are configured (Automated) + title: Ensure sshd access is configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - The status was automated but we need to double check the approach used in this rule. - Therefore I moved it to pending until deeper investigation. - related_rules: - - sshd_use_approved_ciphers - - sshd_approved_ciphers=cis_rhel8 + status: automated + rules: + - sshd_limit_user_access - id: 5.1.5 - title: Ensure sshd KexAlgorithms is configured (Automated) + title: Ensure sshd Banner is configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - The status was automated but we need to double check the approach used in this rule. - Therefore I moved it to pending until deeper investigation. + status: automated rules: - - sshd_use_strong_kex - - sshd_strong_kex=cis_rhel8 + - sshd_enable_warning_banner_net + related_rules: + - sshd_enable_warning_banner - id: 5.1.6 - title: Ensure sshd MACs are configured (Automated) + title: Ensure sshd Ciphers are configured (Automated) levels: - l1_server - l1_workstation - status: pending + status: automated notes: |- The status was automated but we need to double check the approach used in this rule. Therefore I moved it to pending until deeper investigation. - rules: - - sshd_use_strong_macs - - sshd_strong_macs=cis_rhel8 - - - id: 5.1.7 - title: Ensure sshd access is configured (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - sshd_limit_user_access - - - id: 5.1.8 - title: Ensure sshd Banner is configured (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - sshd_enable_warning_banner_net related_rules: - - sshd_enable_warning_banner + - sshd_use_approved_ciphers + - sshd_approved_ciphers=cis_rhel10 - - id: 5.1.9 + - id: 5.1.7 title: Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured (Automated) levels: - l1_server @@ -1487,33 +1648,33 @@ controls: The requirement gives an example of 45 seconds, but is flexible about the values. It is only necessary to ensure there is a timeout configured in alignment to the site policy. rules: - - sshd_idle_timeout_value=5_minutes - sshd_set_idle_timeout + - sshd_idle_timeout_value=5_minutes - sshd_set_keepalive - var_sshd_set_keepalive=1 - - id: 5.1.10 + - id: 5.1.8 title: Ensure sshd DisableForwarding is enabled (Automated) levels: - - l2_server - l1_workstation - status: pending - notes: |- - New templated rule is necessary for "disableforwarding" option. + - l2_server + status: automated related_rules: - sshd_disable_tcp_forwarding - sshd_disable_x11_forwarding + rules: + - sshd_disable_forwarding - - id: 5.1.11 + - id: 5.1.9 title: Ensure sshd GSSAPIAuthentication is disabled (Automated) levels: - - l2_server - l1_workstation + - l2_server status: automated rules: - sshd_disable_gssapi_auth - - id: 5.1.12 + - id: 5.1.10 title: Ensure sshd HostbasedAuthentication is disabled (Automated) levels: - l1_server @@ -1522,7 +1683,7 @@ controls: rules: - disable_host_auth - - id: 5.1.13 + - id: 5.1.11 title: Ensure sshd IgnoreRhosts is enabled (Automated) levels: - l1_server @@ -1531,7 +1692,20 @@ controls: rules: - sshd_disable_rhosts - - id: 5.1.14 + - id: 5.1.12 + title: Ensure sshd KexAlgorithms is configured (Automated) + levels: + - l1_server + - l1_workstation + status: pending + notes: |- + The status was automated but we need to double check the approach used in this rule. + Therefore I moved it to pending until deeper investigation. + rules: + - sshd_use_strong_kex + - sshd_strong_kex=cis_rhel10 + + - id: 5.1.13 title: Ensure sshd LoginGraceTime is configured (Automated) levels: - l1_server @@ -1541,7 +1715,7 @@ controls: - sshd_set_login_grace_time - var_sshd_set_login_grace_time=60 - - id: 5.1.15 + - id: 5.1.14 title: Ensure sshd LogLevel is configured (Automated) levels: - l1_server @@ -1556,6 +1730,19 @@ controls: related_rules: - sshd_set_loglevel_info + - id: 5.1.15 + title: Ensure sshd MACs are configured (Automated) + levels: + - l1_server + - l1_workstation + status: pending + notes: |- + The status was automated but we need to double check the approach used in this rule. + Therefore I moved it to pending until deeper investigation. + rules: + - sshd_use_strong_macs + - sshd_strong_macs=cis_rhel10 + - id: 5.1.16 title: Ensure sshd MaxAuthTries is configured (Automated) levels: @@ -1563,8 +1750,8 @@ controls: - l1_workstation status: automated rules: - - sshd_max_auth_tries_value=4 - sshd_set_max_auth_tries + - sshd_max_auth_tries_value=4 - id: 5.1.17 title: Ensure sshd MaxStartups is configured (Automated) @@ -1665,10 +1852,10 @@ controls: - l1_workstation status: automated rules: - - sudo_require_reauthentication + - sudo_require_authentication - id: 5.2.6 - title: Ensure sudo authentication timeout is configured correctly (Automated) + title: Ensure sudo timestamp_timeout is configured (Automated) levels: - l1_server - l1_workstation @@ -1685,43 +1872,14 @@ controls: notes: |- Members of "wheel" or GID 0 groups are checked by default if the group option is not set for pam_wheel.so module. The recommendation states the group should be empty to reinforce the - use of "sudo" for privileged access. Therefore, members of these groups should be manually - checked or a different group should be informed. - rules: - - var_pam_wheel_group_for_su=cis - - use_pam_wheel_group_for_su - - ensure_pam_wheel_group_empty - - - id: 5.3.1.1 - title: Ensure latest version of pam is installed (Automated) - levels: - - l1_server - - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure PAM package is updated. - - - id: 5.3.1.2 - title: Ensure latest version of authselect is installed (Automated) - levels: - - l1_server - - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure authselect package is updated. - - - id: 5.3.1.3 - title: Ensure latest version of libpwquality is installed (Automated) - levels: - - l1_server - - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure libpwquality package is updated. + use of "sudo" for privileged access. Therefore, members of these groups should be manually + checked or a different group should be informed. rules: - - package_pam_pwquality_installed + - var_pam_wheel_group_for_su=cis + - use_pam_wheel_group_for_su + - ensure_pam_wheel_group_empty - - id: 5.3.2.1 + - id: 5.3.1.1 title: Ensure active authselect profile includes pam modules (Automated) levels: - l1_server @@ -1736,30 +1894,28 @@ controls: related_rules: - no_empty_passwords - - id: 5.3.2.2 + - id: 5.3.1.2 title: Ensure pam_faillock module is enabled (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - This requirement is also indirectly satisfied by the requirement 5.3.3.1. + notes: This requirement is also indirectly satisfied by the requirement 5.3.2.1. rules: - account_password_pam_faillock_password_auth - account_password_pam_faillock_system_auth - - id: 5.3.2.3 + - id: 5.3.1.3 title: Ensure pam_pwquality module is enabled (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - This requirement is also indirectly satisfied by the requirement 5.3.3.2. - related_rules: + notes: This requirement is also indirectly satisfied by the requirement 5.3.2.2. + rules: - package_pam_pwquality_installed - - id: 5.3.2.4 + - id: 5.3.1.4 title: Ensure pam_pwhistory module is enabled (Automated) levels: - l1_server @@ -1767,12 +1923,12 @@ controls: status: automated notes: |- The module is properly enabled by the rules mentioned in related_rules. - Requirements in 5.3.3.3 use these rules. + Requirements in 5.3.2.3 use these rules. related_rules: - accounts_password_pam_pwhistory_remember_password_auth - accounts_password_pam_pwhistory_remember_system_auth - - id: 5.3.2.5 + - id: 5.3.1.5 title: Ensure pam_unix module is enabled (Automated) levels: - l1_server @@ -1785,7 +1941,7 @@ controls: related_rules: - no_empty_passwords - - id: 5.3.3.1.1 + - id: 5.3.2.1.1 title: Ensure password failed attempts lockout is configured (Automated) levels: - l1_server @@ -1795,7 +1951,7 @@ controls: - accounts_passwords_pam_faillock_deny - var_accounts_passwords_pam_faillock_deny=5 - - id: 5.3.3.1.2 + - id: 5.3.2.1.2 title: Ensure password unlock time is configured (Automated) levels: - l1_server @@ -1809,7 +1965,7 @@ controls: - accounts_passwords_pam_faillock_unlock_time - var_accounts_passwords_pam_faillock_unlock_time=900 - - id: 5.3.3.1.3 + - id: 5.3.2.1.3 title: Ensure password failed attempts lockout includes root account (Automated) levels: - l2_server @@ -1818,7 +1974,7 @@ controls: rules: - accounts_passwords_pam_faillock_deny_root - - id: 5.3.3.2.1 + - id: 5.3.2.2.1 title: Ensure password number of changed characters is configured (Automated) levels: - l1_server @@ -1828,7 +1984,7 @@ controls: - accounts_password_pam_difok - var_password_pam_difok=2 - - id: 5.3.3.2.2 + - id: 5.3.2.2.2 title: Ensure password length is configured (Automated) levels: - l1_server @@ -1838,7 +1994,7 @@ controls: - accounts_password_pam_minlen - var_password_pam_minlen=14 - - id: 5.3.3.2.3 + - id: 5.3.2.2.3 title: Ensure password complexity is configured (Manual) levels: - l1_server @@ -1847,7 +2003,7 @@ controls: notes: |- This requirement is expected to be manual. However, in previous versions of the policy it was already automated the configuration of "minclass" option. This posture was kept for - RHEL 9 in this new version. Rules related to other options are informed in related_rules. + RHEL 10 in this new version. Rules related to other options are informed in related_rules. In short, minclass=4 alone can achieve the same result achieved by the combination of the other 4 options mentioned in the policy. rules: @@ -1859,7 +2015,7 @@ controls: - accounts_password_pam_ocredit - accounts_password_pam_ucredit - - id: 5.3.3.2.4 + - id: 5.3.2.2.4 title: Ensure password same consecutive characters is configured (Automated) levels: - l1_server @@ -1869,16 +2025,15 @@ controls: - accounts_password_pam_maxrepeat - var_password_pam_maxrepeat=3 - - id: 5.3.3.2.5 + - id: 5.3.2.2.5 title: Ensure password maximum sequential characters is configured (Automated) levels: - l1_server - l1_workstation - status: planned - notes: |- - A new templated rule and variable are necessary for the maxsequence option. + status: automated + notes: A new templated rule and variable are necessary for the maxsequence option. - - id: 5.3.3.2.6 + - id: 5.3.2.2.6 title: Ensure password dictionary check is enabled (Automated) levels: - l1_server @@ -1888,7 +2043,7 @@ controls: - accounts_password_pam_dictcheck - var_password_pam_dictcheck=1 - - id: 5.3.3.2.7 + - id: 5.3.2.2.7 title: Ensure password quality is enforced for the root user (Automated) levels: - l1_server @@ -1897,7 +2052,7 @@ controls: rules: - accounts_password_pam_enforce_root - - id: 5.3.3.3.1 + - id: 5.3.2.3.1 title: Ensure password history remember is configured (Automated) levels: - l1_server @@ -1915,7 +2070,7 @@ controls: related_rules: - accounts_password_pam_retry - - id: 5.3.3.3.2 + - id: 5.3.2.3.2 title: Ensure password history is enforced for the root user (Automated) levels: - l1_server @@ -1925,32 +2080,31 @@ controls: A new rule needs to be created to check and remediate the enforce_for_root option in /etc/security/pwhistory.conf. accounts_password_pam_enforce_root can be used as reference. - - id: 5.3.3.3.3 + - id: 5.3.2.3.3 title: Ensure pam_pwhistory includes use_authtok (Automated) levels: - l1_server - l1_workstation status: partial notes: |- - In RHEL 9 pam_pwhistory is enabled via authselect feature, as required in 5.3.2.4. The + In RHEL 10 pam_pwhistory is enabled via authselect feature, as required in 5.3.1.4. The feature automatically set "use_authok" option. In any case, we don't have a rule to check this option specifically. related_rules: - accounts_password_pam_pwhistory_remember_password_auth - accounts_password_pam_pwhistory_remember_system_auth - - id: 5.3.3.4.1 + - id: 5.3.2.4.1 title: Ensure pam_unix does not include nullok (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - The rule more specifically used in this requirement also satify the requirement 5.3.2.5. + notes: The rule more specifically used in this requirement also satify the requirement 5.3.1.5. rules: - no_empty_passwords - - id: 5.3.3.4.2 + - id: 5.3.2.4.2 title: Ensure pam_unix does not include remember (Automated) levels: - l1_server @@ -1963,29 +2117,28 @@ controls: https://bugzilla.redhat.com/show_bug.cgi?id=1778929 A new rule needs to be created to remove the remember option from pam_unix module. - - id: 5.3.3.4.3 + - id: 5.3.2.4.3 title: Ensure pam_unix includes a strong password hashing algorithm (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - Changes in logindefs mentioned in this requirement are more specifically covered by 5.4.1.4 + notes: Changes in logindefs mentioned in this requirement are more specifically covered by 5.4.1.4 rules: - set_password_hashing_algorithm_systemauth - set_password_hashing_algorithm_passwordauth - var_password_hashing_algorithm_pam=yescrypt - - id: 5.3.3.4.4 + - id: 5.3.2.4.4 title: Ensure pam_unix includes use_authtok (Automated) levels: - l1_server - l1_workstation status: partial notes: |- - In RHEL 9 pam_unix is enabled by default in all authselect profiles already with the + In RHEL 10 pam_unix is enabled by default in all authselect profiles already with the use_authtok option set. In any case, we don't have a rule to check this option specifically, - like in 5.3.3.3.3. + like in 5.3.2.3.3. - id: 5.4.1.1 title: Ensure password expiration is configured (Automated) @@ -2033,7 +2186,6 @@ controls: - set_password_hashing_algorithm_libuserconf - set_password_hashing_algorithm_logindefs - var_password_hashing_algorithm=yescrypt - - var_password_hashing_algorithm_pam=yescrypt - id: 5.4.1.5 title: Ensure inactive password lock is configured (Automated) @@ -2082,9 +2234,9 @@ controls: levels: - l1_server - l1_workstation - status: pending - notes: |- - New rule is necessary. + status: automated + rules: + - groups_no_zero_gid_except_root - id: 5.4.2.4 title: Ensure root account access is controlled (Automated) @@ -2110,10 +2262,9 @@ controls: levels: - l1_server - l1_workstation - status: pending - notes: |- - There is no rule to ensure umask in /root/.bash_profile and /root/.bashrc. A new rule have - to be created. It can be based on accounts_umask_interactive_users. + status: automated + rules: + - accounts_umask_root - id: 5.4.2.7 title: Ensure system accounts do not have a valid login shell (Automated) @@ -2130,19 +2281,17 @@ controls: levels: - l1_server - l1_workstation - status: pending - notes: |- - New rule is necessary. + status: automated + notes: New rule is necessary. - id: 5.4.3.1 title: Ensure nologin is not listed in /etc/shells (Automated) levels: - l2_server - l2_workstation - status: pending - notes: |- - It is necessary to create a new rule to check and remove nologin from /etc/shells. - The no_tmux_in_shells rule can be used as referece. + status: automated + rules: + - no_nologin_in_shells - id: 5.4.3.2 title: Ensure default user shell timeout is configured (Automated) @@ -2197,7 +2346,7 @@ controls: - aide_use_fips_hashes - id: 6.2.1.1 - title: Ensure journald service is enabled and active (Automated) + title: Ensure journald service is active (Automated) levels: - l1_server - l1_workstation @@ -2229,68 +2378,66 @@ controls: It is necessary to create a new rule to check the status of journald and rsyslog. It would also be necessary a new rule to disable or remove rsyslog. - - id: 6.2.2.1.1 - title: Ensure systemd-journal-remote is installed (Automated) + - id: 6.2.2.2 + title: Ensure journald ForwardToSyslog is disabled (Automated) levels: - l1_server - l1_workstation - status: automated - rules: - - package_systemd-journal-remote_installed + status: pending + notes: This rule conflicts with 6.2.3.3. More investigation is needed to properly solve this. + related_rules: + - journald_forward_to_syslog - - id: 6.2.2.1.2 - title: Ensure systemd-journal-upload authentication is configured (Manual) + - id: 6.2.2.3 + title: Ensure journald Compress is configured (Automated) levels: - l1_server - l1_workstation - status: manual + status: automated + rules: + - journald_compress - - id: 6.2.2.1.3 - title: Ensure systemd-journal-upload is enabled and active (Automated) + - id: 6.2.2.4 + title: Ensure journald Storage is configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - New templated rule is necessary. + status: automated + rules: + - journald_storage - - id: 6.2.2.1.4 - title: Ensure systemd-journal-remote service is not in use (Automated) + - id: 6.2.2.1.1 + title: Ensure systemd-journal-remote is installed (Automated) levels: - l1_server - l1_workstation status: automated rules: - - socket_systemd-journal-remote_disabled + - package_systemd-journal-remote_installed - - id: 6.2.2.2 - title: Ensure journald ForwardToSyslog is disabled (Automated) + - id: 6.2.2.1.2 + title: Ensure systemd-journal-upload authentication is configured (Manual) levels: - l1_server - l1_workstation - status: pending - notes: |- - This rule conflicts with 6.2.3.3. More investigation is needed to properly solve this. - related_rules: - - journald_forward_to_syslog + status: manual - - id: 6.2.2.3 - title: Ensure journald Compress is configured (Automated) + - id: 6.2.2.1.3 + title: Ensure systemd-journal-upload is enabled and active (Automated) levels: - l1_server - l1_workstation - status: automated - rules: - - journald_compress + status: pending + notes: New templated rule is necessary. - - id: 6.2.2.4 - title: Ensure journald Storage is configured (Automated) + - id: 6.2.2.1.4 + title: Ensure systemd-journal-remote service is not in use (Automated) levels: - l1_server - l1_workstation status: automated rules: - - journald_storage + - socket_systemd-journal-remote_disabled - id: 6.2.3.1 title: Ensure rsyslog is installed (Automated) @@ -2370,8 +2517,7 @@ controls: - l1_server - l1_workstation status: automated - notes: |- - It is not harmful to run these rules even if rsyslog is not installed or active. + notes: It is not harmful to run these rules even if rsyslog is not installed or active. rules: - rsyslog_files_groupownership - rsyslog_files_ownership @@ -2397,7 +2543,7 @@ controls: - grub2_audit_argument - id: 6.3.1.3 - title: Ensure audit_backlog_limit is sufficient (Automated) + title: Ensure audit_backlog_limit is configured (Automated) levels: - l2_server - l2_workstation @@ -2443,8 +2589,8 @@ controls: rules: - auditd_data_disk_error_action - auditd_data_disk_full_action - - var_auditd_disk_error_action=cis_rhel8 - - var_auditd_disk_full_action=cis_rhel8 + - var_auditd_disk_error_action=cis_rhel10 + - var_auditd_disk_full_action=cis_rhel10 - id: 6.3.2.4 title: Ensure system warns when audit logs are low on space (Automated) @@ -2457,11 +2603,11 @@ controls: - auditd_data_retention_admin_space_left_action - auditd_data_retention_space_left_action - var_auditd_action_mail_acct=root - - var_auditd_admin_space_left_action=cis_rhel8 - - var_auditd_space_left_action=cis_rhel8 + - var_auditd_admin_space_left_action=cis_rhel10 + - var_auditd_space_left_action=cis_rhel10 - id: 6.3.3.1 - title: Ensure changes to system administration scope (sudoers) is collected (Automated) + title: Ensure modification of the /etc/sudoers file is collected (Automated) levels: - l2_server - l2_workstation @@ -2502,18 +2648,58 @@ controls: - audit_rules_time_stime - id: 6.3.3.5 - title: Ensure events that modify the system's network environment are collected (Automated) + title: Ensure events that modify sethostname and setdomainname are collected (Automated) levels: - l2_server - l2_workstation - status: partial - notes: |- - These rules are not covering "/etc/hostname" and "/etc/NetworkManager/". + status: automated + notes: This requirement is covered by 6.3.3.6. + related_rules: + - audit_rules_networkconfig_modification + + - id: 6.3.3.6 + title: Ensure events that modify /etc/issue and /etc/issue.net are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + # TODO: The rule covering this requirement needs to be split into multiple rules. rules: - audit_rules_networkconfig_modification + + - id: 6.3.3.7 + title: Ensure events that modify /etc/hosts and /etc/hostname are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + notes: This requirement is partially covered by 6.3.3.6. + related_rules: + - audit_rules_networkconfig_modification + + - id: 6.3.3.8 + title: Ensure events that modify /etc/sysconfig/network and /etc/sysconfig/network-scripts/ are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + notes: This requirement is partially covered by 6.3.3.6. + rules: - audit_rules_networkconfig_modification_network_scripts + related_rules: + - audit_rules_networkconfig_modification - - id: 6.3.3.6 + - id: 6.3.3.9 + title: Ensure events that modify /etc/NetworkManager directory are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + notes: This requirement is covered by 6.3.3.6. + related_rules: + - audit_rules_networkconfig_modification + + - id: 6.3.3.10 title: Ensure use of privileged commands are collected (Automated) levels: - l2_server @@ -2522,7 +2708,7 @@ controls: rules: - audit_rules_privileged_commands - - id: 6.3.3.7 + - id: 6.3.3.11 title: Ensure unsuccessful file access attempts are collected (Automated) levels: - l2_server @@ -2535,44 +2721,96 @@ controls: - audit_rules_unsuccessful_file_modification_openat - audit_rules_unsuccessful_file_modification_truncate - - id: 6.3.3.8 - title: Ensure events that modify user/group information are collected (Automated) + - id: 6.3.3.12 + title: Ensure events that modify /etc/group information are collected (Automated) levels: - l2_server - l2_workstation - status: partial - notes: |- - Missing rules to check "/etc/nsswitch.conf", "/etc/pam.conf" and "/etc/pam.d" + status: automated rules: - audit_rules_usergroup_modification_group - - audit_rules_usergroup_modification_gshadow - - audit_rules_usergroup_modification_opasswd + + - id: 6.3.3.13 + title: Ensure events that modify /etc/passwd information are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: - audit_rules_usergroup_modification_passwd + + - id: 6.3.3.14 + title: Ensure events that modify /etc/shadow and /etc/gshadow are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - audit_rules_usergroup_modification_gshadow - audit_rules_usergroup_modification_shadow - - id: 6.3.3.9 - title: Ensure discretionary access control permission modification events are collected (Automated) + - id: 6.3.3.15 + title: Ensure events that modify /etc/security/opasswd are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - audit_rules_usergroup_modification_opasswd + + - id: 6.3.3.16 + title: Ensure events that modify /etc/nsswitch.conf file are collected (Automated) + levels: + - l2_server + - l2_workstation + status: pending + + - id: 6.3.3.17 + title: Ensure events that modify /etc/pam.conf and /etc/pam.d/ information are collected (Automated) + levels: + - l2_server + - l2_workstation + status: pending + + - id: 6.3.3.18 + title: Ensure discretionary access control permission modification events chmod,fchmod,fchmodat,fchmodat2 are collected (Automated) levels: - l2_server - l2_workstation status: automated rules: - audit_rules_dac_modification_chmod - - audit_rules_dac_modification_chown - audit_rules_dac_modification_fchmod - audit_rules_dac_modification_fchmodat - audit_rules_dac_modification_fchmodat2 + + - id: 6.3.3.19 + title: Ensure discretionary access control permission modification events chown,fchown,lchown,fchownat are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - audit_rules_dac_modification_chown - audit_rules_dac_modification_fchown - audit_rules_dac_modification_fchownat + - audit_rules_dac_modification_lchown + + - id: 6.3.3.20 + title: Ensure discretionary access control permission modification events setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: - audit_rules_dac_modification_fremovexattr - audit_rules_dac_modification_fsetxattr - - audit_rules_dac_modification_lchown - audit_rules_dac_modification_lremovexattr - audit_rules_dac_modification_lsetxattr - audit_rules_dac_modification_removexattr - audit_rules_dac_modification_setxattr - - id: 6.3.3.10 + - id: 6.3.3.21 title: Ensure successful file system mounts are collected (Automated) levels: - l2_server @@ -2581,7 +2819,7 @@ controls: rules: - audit_rules_media_export - - id: 6.3.3.11 + - id: 6.3.3.22 title: Ensure session initiation information is collected (Automated) levels: - l2_server @@ -2592,7 +2830,7 @@ controls: - audit_rules_session_events_btmp - audit_rules_session_events_wtmp - - id: 6.3.3.12 + - id: 6.3.3.23 title: Ensure login and logout events are collected (Automated) levels: - l2_server @@ -2603,8 +2841,18 @@ controls: - audit_rules_login_events_lastlog - var_accounts_passwords_pam_faillock_dir=run - - id: 6.3.3.13 - title: Ensure file deletion events by users are collected (Automated) + - id: 6.3.3.24 + title: Ensure unlink file deletion events by users are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - audit_rules_file_deletion_events_unlink + - audit_rules_file_deletion_events_unlinkat + + - id: 6.3.3.25 + title: Ensure rename file deletion events by users are collected (Automated) levels: - l2_server - l2_workstation @@ -2613,10 +2861,8 @@ controls: - audit_rules_file_deletion_events_rename - audit_rules_file_deletion_events_renameat - audit_rules_file_deletion_events_renameat2 - - audit_rules_file_deletion_events_unlink - - audit_rules_file_deletion_events_unlinkat - - id: 6.3.3.14 + - id: 6.3.3.26 title: Ensure events that modify the system's Mandatory Access Controls are collected (Automated) levels: - l2_server @@ -2626,7 +2872,7 @@ controls: - audit_rules_mac_modification_etc_selinux - audit_rules_mac_modification_usr_share - - id: 6.3.3.15 + - id: 6.3.3.27 title: Ensure successful and unsuccessful attempts to use the chcon command are collected (Automated) levels: - l2_server @@ -2635,7 +2881,7 @@ controls: rules: - audit_rules_execution_chcon - - id: 6.3.3.16 + - id: 6.3.3.28 title: Ensure successful and unsuccessful attempts to use the setfacl command are collected (Automated) levels: - l2_server @@ -2644,7 +2890,7 @@ controls: rules: - audit_rules_execution_setfacl - - id: 6.3.3.17 + - id: 6.3.3.29 title: Ensure successful and unsuccessful attempts to use the chacl command are collected (Automated) levels: - l2_server @@ -2653,7 +2899,7 @@ controls: rules: - audit_rules_execution_chacl - - id: 6.3.3.18 + - id: 6.3.3.30 title: Ensure successful and unsuccessful attempts to use the usermod command are collected (Automated) levels: - l2_server @@ -2662,20 +2908,52 @@ controls: rules: - audit_rules_privileged_commands_usermod - - id: 6.3.3.19 + - id: 6.3.3.31 title: Ensure kernel module loading unloading and modification is collected (Automated) levels: - l2_server - l2_workstation status: automated rules: - - audit_rules_kernel_module_loading_delete - - audit_rules_kernel_module_loading_finit + - audit_rules_privileged_commands_kmod + + - id: 6.3.3.32 + title: Ensure kernel "init_module" and "finit_module" loading unloading and modification is collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: - audit_rules_kernel_module_loading_init + - audit_rules_kernel_module_loading_finit + + - id: 6.3.3.33 + title: Ensure kernel "delete_module" loading unloading and modification is collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - audit_rules_kernel_module_loading_delete + + - id: 6.3.3.34 + title: Ensure kernel "create_module" and "query_module" loading unloading and modification is collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - audit_rules_kernel_module_loading_create - audit_rules_kernel_module_loading_query - - audit_rules_privileged_commands_kmod - - id: 6.3.3.20 + - id: 6.3.3.35 + title: Ensure the audit configuration is loaded regardless of errors (Automated) + levels: + - l2_server + - l2_workstation + status: pending + + - id: 6.3.3.36 title: Ensure the audit configuration is immutable (Automated) levels: - l2_server @@ -2684,7 +2962,7 @@ controls: rules: - audit_rules_immutable - - id: 6.3.3.21 + - id: 6.3.3.37 title: Ensure the running and on disk configuration is the same (Manual) levels: - l2_server @@ -2782,7 +3060,7 @@ controls: - file_groupownership_audit_binaries - id: 7.1.1 - title: Ensure permissions on /etc/passwd are configured (Automated) + title: Ensure access to /etc/passwd is configured (Automated) levels: - l1_server - l1_workstation @@ -2793,7 +3071,7 @@ controls: - file_permissions_etc_passwd - id: 7.1.2 - title: Ensure permissions on /etc/passwd- are configured (Automated) + title: Ensure access to /etc/passwd- is configured (Automated) levels: - l1_server - l1_workstation @@ -2804,7 +3082,7 @@ controls: - file_permissions_backup_etc_passwd - id: 7.1.3 - title: Ensure permissions on /etc/group are configured (Automated) + title: Ensure access to /etc/group is configured (Automated) levels: - l1_server - l1_workstation @@ -2815,7 +3093,7 @@ controls: - file_permissions_etc_group - id: 7.1.4 - title: Ensure permissions on /etc/group- are configured (Automated) + title: Ensure access to /etc/group- is configured (Automated) levels: - l1_server - l1_workstation @@ -2826,7 +3104,7 @@ controls: - file_permissions_backup_etc_group - id: 7.1.5 - title: Ensure permissions on /etc/shadow are configured (Automated) + title: Ensure access to /etc/shadow is configured (Automated) levels: - l1_server - l1_workstation @@ -2837,7 +3115,7 @@ controls: - file_permissions_etc_shadow - id: 7.1.6 - title: Ensure permissions on /etc/shadow- are configured (Automated) + title: Ensure access to /etc/shadow- is configured (Automated) levels: - l1_server - l1_workstation @@ -2848,7 +3126,7 @@ controls: - file_permissions_backup_etc_shadow - id: 7.1.7 - title: Ensure permissions on /etc/gshadow are configured (Automated) + title: Ensure access to /etc/gshadow is configured (Automated) levels: - l1_server - l1_workstation @@ -2859,7 +3137,7 @@ controls: - file_permissions_etc_gshadow - id: 7.1.8 - title: Ensure permissions on /etc/gshadow- are configured (Automated) + title: Ensure access to /etc/gshadow- is configured (Automated) levels: - l1_server - l1_workstation @@ -2870,7 +3148,7 @@ controls: - file_permissions_backup_etc_gshadow - id: 7.1.9 - title: Ensure permissions on /etc/shells are configured (Automated) + title: Ensure access to /etc/shells is configured (Automated) levels: - l1_server - l1_workstation @@ -2881,13 +3159,12 @@ controls: - file_permissions_etc_shells - id: 7.1.10 - title: Ensure permissions on /etc/security/opasswd are configured (Automated) + title: Ensure access to /etc/security/opasswd is configured (Automated) levels: - l1_server - l1_workstation - status: partial + status: automated rules: - # TODO: We need another rule that checks /etc/security/opasswd.old - file_etc_security_opasswd - id: 7.1.11 @@ -2906,8 +3183,8 @@ controls: - l1_server - l1_workstation status: partial - rules: # TODO: add rules for unowned/ungrouped directories + rules: - no_files_unowned_by_user - file_permissions_ungroupowned @@ -2921,16 +3198,6 @@ controls: - file_permissions_unauthorized_suid - file_permissions_unauthorized_sgid - - id: 7.1.14 - title: Audit system file permissions (Manual) - levels: - - l2_server - - l2_workstation - status: manual - related_rules: - - rpm_verify_permissions - - rpm_verify_ownership - - id: 7.2.1 title: Ensure accounts in /etc/passwd use shadowed passwords (Automated) levels: @@ -3012,9 +3279,8 @@ controls: levels: - l1_server - l1_workstation - notes: |- - Missing a rule to check that .bash_history is mode 0600 or more restrictive. status: partial + notes: Missing a rule to check that .bash_history is mode 0600 or more restrictive. rules: - accounts_user_dot_group_ownership - accounts_user_dot_user_ownership diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var index 2131e03638c3..c8c59c4a4891 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var @@ -20,3 +20,4 @@ options: ignore: ignore cis_rhel8: single|halt cis_rhel9: single|halt + cis_rhel10: single|halt diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var index 7ea8d50de562..12ed949df037 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var @@ -23,6 +23,7 @@ options: rhel8: syslog|single|halt cis_rhel8: syslog|single|halt cis_rhel9: syslog|single|halt + cis_rhel10: syslog|single|halt cis_ubuntu2404: syslog|single|halt cis_debian12: syslog|single|halt diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var index 7bbb940a02fb..efa7096e0f00 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var @@ -24,5 +24,6 @@ options: rhel8: syslog|single|halt cis_rhel8: syslog|single|halt cis_rhel9: halt|single + cis_rhel10: halt|single cis_ubuntu2404: halt|single cis_debian12: halt|single diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var index f5d81f5ccf9e..53eb3f939a7e 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var @@ -20,3 +20,4 @@ options: ignore: ignore cis_rhel8: email|exec|single|halt cis_rhel9: email|exec|single|halt + cis_rhel10: email|exec|single|halt diff --git a/linux_os/guide/services/base/service_cockpit_disabled/rule.yml b/linux_os/guide/services/base/service_cockpit_disabled/rule.yml index 75c1154b8264..ae327a56e63b 100644 --- a/linux_os/guide/services/base/service_cockpit_disabled/rule.yml +++ b/linux_os/guide/services/base/service_cockpit_disabled/rule.yml @@ -13,6 +13,9 @@ rationale: |- severity: medium +identifiers: + cce@rhel10: CCE-87509-6 + platform: system_with_kernel ocil_clause: |- diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml index 2b38acabeb23..0464c8bff84d 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml @@ -11,6 +11,9 @@ rationale: |- severity: medium +identifiers: + cce@rhel10: CCE-87508-8 + ocil_clause: "The DisableForwarding option exists and is yes" ocil: |- diff --git a/linux_os/guide/services/ssh/sshd_strong_kex.var b/linux_os/guide/services/ssh/sshd_strong_kex.var index 059b2674fe3a..d4a78a3fe45e 100644 --- a/linux_os/guide/services/ssh/sshd_strong_kex.var +++ b/linux_os/guide/services/ssh/sshd_strong_kex.var @@ -15,6 +15,7 @@ options: pcidss: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 cis_rhel8: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 cis_rhel9: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 + cis_rhel10: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 cis_sle12: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 cis_sle15: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 cis_ubuntu2204: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 diff --git a/linux_os/guide/services/ssh/sshd_strong_macs.var b/linux_os/guide/services/ssh/sshd_strong_macs.var index d7c2a416c849..03f8dee10d54 100644 --- a/linux_os/guide/services/ssh/sshd_strong_macs.var +++ b/linux_os/guide/services/ssh/sshd_strong_macs.var @@ -14,6 +14,7 @@ options: default: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 cis_rhel8: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com cis_rhel9: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com + cis_rhel10: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com cis_sle12: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 cis_sle15: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 cis_tencentos4: hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com diff --git a/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml index 9e5476780f57..9477c5580778 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml @@ -17,6 +17,7 @@ rationale: |- severity: medium identifiers: + cce@rhel10: CCE-87072-5 cce@sle15: CCE-92592-5 ocil_clause: 'nologin is listed in /etc/shells' diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml index 638f2ac79d84..eed8dfb0c31e 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml @@ -15,6 +15,7 @@ rationale: |- severity: high identifiers: + cce@rhel10: CCE-87073-3 cce@sle15: CCE-92565-1 ocil_clause: 'any groups other than "root" have a GID of "0"' diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml index 37f04d6bd5c4..e9f38a6bdc15 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml @@ -16,6 +16,7 @@ rationale: |- severity: medium identifiers: + cce@rhel10: CCE-87074-1 cce@sle15: CCE-92484-5 platform: package[bash] diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml index 137edcb9f0e4..34b52dee5274 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml @@ -13,10 +13,11 @@ rationale: |- severity: medium identifiers: + cce@rhel10: CCE-87075-8 cce@sle12: CCE-83248-5 cce@sle15: CCE-85725-0 cce@slmicro5: CCE-93641-9 - cce@slmicro6: CCE-95085-7 + cce@slmicro6: CCE-95085-7 references: nist: CM-6(b),CM-6.1(iv) diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml index 64c63b49d78a..b090a1a5a556 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml @@ -17,6 +17,7 @@ rationale: |- severity: low identifiers: + cce@rhel10: CCE-87507-0 cce@sle15: CCE-92579-2 platform: system_with_kernel diff --git a/products/rhel10/profiles/cis.profile b/products/rhel10/profiles/cis.profile index 3d1b4a46b34b..8b38b00a53b3 100644 --- a/products/rhel10/profiles/cis.profile +++ b/products/rhel10/profiles/cis.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 2 - Server" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l2_server diff --git a/products/rhel10/profiles/cis_server_l1.profile b/products/rhel10/profiles/cis_server_l1.profile index dd3bfe6d1ea6..94bd1c5a5244 100644 --- a/products/rhel10/profiles/cis_server_l1.profile +++ b/products/rhel10/profiles/cis_server_l1.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 1 - Server" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l1_server diff --git a/products/rhel10/profiles/cis_workstation_l1.profile b/products/rhel10/profiles/cis_workstation_l1.profile index 40218aac378f..f0814c46a26c 100644 --- a/products/rhel10/profiles/cis_workstation_l1.profile +++ b/products/rhel10/profiles/cis_workstation_l1.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 1 - Workstation" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l1_workstation diff --git a/products/rhel10/profiles/cis_workstation_l2.profile b/products/rhel10/profiles/cis_workstation_l2.profile index 4e0a1723dcb8..3b0e00e529ed 100644 --- a/products/rhel10/profiles/cis_workstation_l2.profile +++ b/products/rhel10/profiles/cis_workstation_l2.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 2 - Workstation" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l2_workstation diff --git a/products/rhel10/profiles/default.profile b/products/rhel10/profiles/default.profile index 834f22559dba..46b9c336e29d 100644 --- a/products/rhel10/profiles/default.profile +++ b/products/rhel10/profiles/default.profile @@ -34,3 +34,10 @@ selections: - package_scap-security-guide_installed - set_password_hashing_yescrypt_cost_factor_logindefs - var_authselect_profile=local + - audit_rules_networkconfig_modification_network_scripts + - package_pam_pwquality_installed + - journald_compress + - socket_systemd-journal-remote_disabled + - package_systemd-journal-remote_installed + - journald_storage + - partition_for_dev_shm diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 2c6965a5ae7c..7b8e3aa90354 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -229,10 +229,6 @@ CCE-87062-6 CCE-87063-4 CCE-87064-2 CCE-87068-3 -CCE-87072-5 -CCE-87073-3 -CCE-87074-1 -CCE-87075-8 CCE-87076-6 CCE-87078-2 CCE-87079-0 @@ -487,9 +483,6 @@ CCE-87500-5 CCE-87501-3 CCE-87503-9 CCE-87505-4 -CCE-87507-0 -CCE-87508-8 -CCE-87509-6 CCE-87510-4 CCE-87511-2 CCE-87512-0 diff --git a/tests/data/profile_stability/rhel10/cis.profile b/tests/data/profile_stability/rhel10/cis.profile index 347c6fb734d2..7e403c75676e 100644 --- a/tests/data/profile_stability/rhel10/cis.profile +++ b/tests/data/profile_stability/rhel10/cis.profile @@ -30,6 +30,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -60,6 +61,7 @@ audit_rules_file_deletion_events_renameat2 audit_rules_file_deletion_events_unlink audit_rules_file_deletion_events_unlinkat audit_rules_immutable +audit_rules_kernel_module_loading_create audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit audit_rules_kernel_module_loading_init @@ -108,7 +110,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -125,6 +126,7 @@ dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits directory_permissions_var_log_audit disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -226,6 +228,7 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_audit_argument grub2_audit_backlog_limit_argument grub2_enable_selinux @@ -234,6 +237,17 @@ has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_firewire-core_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_overlayfs_disabled +kernel_module_rds_disabled kernel_module_sctp_disabled kernel_module_squashfs_disabled kernel_module_tipc_disabled @@ -264,6 +278,7 @@ no_empty_passwords_etc_shadow no_files_unowned_by_user no_forward_files no_netrc_files +no_nologin_in_shells no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed @@ -282,7 +297,6 @@ package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed package_openldap-clients_removed package_pam_pwquality_installed @@ -316,11 +330,11 @@ service_auditd_enabled service_autofs_disabled service_avahi-daemon_disabled service_bluetooth_disabled +service_cockpit_disabled service_crond_enabled service_cups_disabled service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf @@ -329,6 +343,7 @@ set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth socket_systemd-journal-remote_disabled sshd_disable_empty_passwords +sshd_disable_forwarding sshd_disable_gssapi_auth sshd_disable_rhosts sshd_disable_root_login @@ -345,20 +360,26 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_protected_symlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -398,6 +419,8 @@ sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su var_account_disable_post_pw_expiration=30 var_accounts_maximum_age_login_defs=365 @@ -409,12 +432,12 @@ var_accounts_passwords_pam_faillock_unlock_time=900 var_accounts_tmout=15_min var_accounts_user_umask=027 var_auditd_action_mail_acct=root -var_auditd_admin_space_left_action=cis_rhel8 -var_auditd_disk_error_action=cis_rhel8 -var_auditd_disk_full_action=cis_rhel8 +var_auditd_admin_space_left_action=cis_rhel10 +var_auditd_disk_error_action=cis_rhel10 +var_auditd_disk_full_action=cis_rhel10 var_auditd_max_log_file=6 var_auditd_max_log_file_action=keep_logs -var_auditd_space_left_action=cis_rhel8 +var_auditd_space_left_action=cis_rhel10 var_authselect_profile=local var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis diff --git a/tests/data/profile_stability/rhel10/cis_server_l1.profile b/tests/data/profile_stability/rhel10/cis_server_l1.profile index 4a079ca18322..a663b7f4c205 100644 --- a/tests/data/profile_stability/rhel10/cis_server_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_server_l1.profile @@ -27,6 +27,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -41,7 +42,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -57,6 +57,7 @@ dconf_gnome_screensaver_user_locks dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -149,12 +150,25 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_firewire-core_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_rds_disabled +kernel_module_sctp_disabled +kernel_module_tipc_disabled kernel_module_usb-storage_disabled login_banner_text=cis_banners mount_option_dev_shm_nodev @@ -196,7 +210,6 @@ package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed package_pam_pwquality_installed package_rsync_removed @@ -226,7 +239,6 @@ service_crond_enabled service_cups_disabled service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf @@ -250,19 +262,25 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile +sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -285,7 +303,6 @@ sysctl_net_ipv4_icmp_echo_ignore_broadcasts sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled sysctl_net_ipv4_icmp_ignore_bogus_error_responses sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled -sysctl_net_ipv4_ip_forward sysctl_net_ipv4_tcp_syncookies sysctl_net_ipv4_tcp_syncookies_value=enabled sysctl_net_ipv6_conf_all_accept_ra @@ -302,6 +319,8 @@ sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su var_account_disable_post_pw_expiration=30 var_accounts_maximum_age_login_defs=365 diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile index 4f4f9decda7d..a6fc83e8a5b5 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile @@ -27,6 +27,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -41,7 +42,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -55,6 +55,7 @@ dconf_gnome_screensaver_user_locks dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -147,12 +148,24 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_rds_disabled +kernel_module_sctp_disabled +kernel_module_tipc_disabled login_banner_text=cis_banners mount_option_dev_shm_nodev mount_option_dev_shm_noexec @@ -193,7 +206,6 @@ package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed package_pam_pwquality_installed package_rsync_removed @@ -218,7 +230,6 @@ selinux_policytype service_crond_enabled service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf @@ -227,6 +238,7 @@ set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth socket_systemd-journal-remote_disabled sshd_disable_empty_passwords +sshd_disable_forwarding sshd_disable_gssapi_auth sshd_disable_rhosts sshd_disable_root_login @@ -243,19 +255,25 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile +sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -295,6 +313,8 @@ sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su var_account_disable_post_pw_expiration=30 var_accounts_maximum_age_login_defs=365 diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile index 2b4d49fd2dd7..fe5328336ac5 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile @@ -30,6 +30,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -60,6 +61,7 @@ audit_rules_file_deletion_events_renameat2 audit_rules_file_deletion_events_unlink audit_rules_file_deletion_events_unlinkat audit_rules_immutable +audit_rules_kernel_module_loading_create audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit audit_rules_kernel_module_loading_init @@ -108,7 +110,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -125,6 +126,7 @@ dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits directory_permissions_var_log_audit disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -226,6 +228,7 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_audit_argument grub2_audit_backlog_limit_argument grub2_enable_selinux @@ -234,6 +237,17 @@ has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_firewire-core_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_overlayfs_disabled +kernel_module_rds_disabled kernel_module_sctp_disabled kernel_module_squashfs_disabled kernel_module_tipc_disabled @@ -264,6 +278,7 @@ no_empty_passwords_etc_shadow no_files_unowned_by_user no_forward_files no_netrc_files +no_nologin_in_shells no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed @@ -281,7 +296,6 @@ package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed package_openldap-clients_removed package_pam_pwquality_installed @@ -314,10 +328,10 @@ service_auditd_enabled service_autofs_disabled service_avahi-daemon_disabled service_bluetooth_disabled +service_cockpit_disabled service_crond_enabled service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf @@ -326,6 +340,7 @@ set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth socket_systemd-journal-remote_disabled sshd_disable_empty_passwords +sshd_disable_forwarding sshd_disable_gssapi_auth sshd_disable_rhosts sshd_disable_root_login @@ -342,20 +357,26 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_protected_symlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -395,6 +416,8 @@ sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su var_account_disable_post_pw_expiration=30 var_accounts_maximum_age_login_defs=365 @@ -406,12 +429,12 @@ var_accounts_passwords_pam_faillock_unlock_time=900 var_accounts_tmout=15_min var_accounts_user_umask=027 var_auditd_action_mail_acct=root -var_auditd_admin_space_left_action=cis_rhel8 -var_auditd_disk_error_action=cis_rhel8 -var_auditd_disk_full_action=cis_rhel8 +var_auditd_admin_space_left_action=cis_rhel10 +var_auditd_disk_error_action=cis_rhel10 +var_auditd_disk_full_action=cis_rhel10 var_auditd_max_log_file=6 var_auditd_max_log_file_action=keep_logs -var_auditd_space_left_action=cis_rhel8 +var_auditd_space_left_action=cis_rhel10 var_authselect_profile=local var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis