From 208c6b233c0f8fe64d129f2fbd1f93e2d3b14689 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Fri, 5 Sep 2025 19:06:44 +0200 Subject: [PATCH 01/25] Refresh CIS Control File for RHEL10 release 1.0. --- controls/cis_rhel10.yml | 1238 ++++++++++++++++++++++----------------- 1 file changed, 690 insertions(+), 548 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index e0b5a9530bcc..769cce5ff919 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -1,8 +1,7 @@ ---- -policy: 'DRAFT - CIS Benchmark for Red Hat Enterprise Linux 10' -title: 'DRAFT - CIS Benchmark for Red Hat Enterprise Linux 10' +policy: CIS Benchmark for Red Hat Enterprise Linux 10 +title: CIS Benchmark for Red Hat Enterprise Linux 10 id: cis_rhel10 -version: 'Draft' +version: 1.0 source: https://www.cisecurity.org/cis-benchmarks/#red_hat_linux levels: @@ -19,6 +18,7 @@ reference_type: cis product: rhel10 controls: + - id: reload_dconf_db title: Reload Dconf database levels: @@ -30,7 +30,61 @@ controls: rules: - dconf_db_up_to_date + - id: 1.1.1.1 + title: Ensure cramfs kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_cramfs_disabled + + - id: 1.1.1.2 + title: Ensure freevxfs kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_freevxfs_disabled + + - id: 1.1.1.3 + title: Ensure hfs kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_hfs_disabled + + - id: 1.1.1.4 + title: Ensure hfsplus kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_hfsplus_disabled + + - id: 1.1.1.5 + title: Ensure jffs2 kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_jffs2_disabled + - id: 1.1.1.6 + title: Ensure overlay kernel module is not available (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - kernel_module_overlayfs_disabled + + - id: 1.1.1.7 title: Ensure squashfs kernel module is not available (Automated) levels: - l2_server @@ -39,7 +93,7 @@ controls: rules: - kernel_module_squashfs_disabled - - id: 1.1.1.7 + - id: 1.1.1.8 title: Ensure udf kernel module is not available (Automated) levels: - l2_server @@ -48,7 +102,14 @@ controls: rules: - kernel_module_udf_disabled - - id: 1.1.1.8 + - id: 1.1.1.9 + title: Ensure firewire-core kernel module is not available (Automated) + levels: + - l1_server + - l2_workstation + status: automated + + - id: 1.1.1.10 title: Ensure usb-storage kernel module is not available (Automated) levels: - l1_server @@ -57,21 +118,19 @@ controls: rules: - kernel_module_usb-storage_disabled - - id: 1.1.1.9 + - id: 1.1.1.11 title: Ensure unused filesystems kernel modules are not available (Manual) levels: - l1_server - - l2_workstation + - l1_workstation status: manual - id: 1.1.2.1.1 - title: Ensure /tmp is a separate partition (Automated) + title: Ensure /tmp is tmpfs or a separate partition (Automated) levels: - l1_server - l1_workstation status: automated - rules: - - partition_for_tmp - id: 1.1.2.1.2 title: Ensure nodev option set on /tmp partition (Automated) @@ -101,13 +160,11 @@ controls: - mount_option_tmp_noexec - id: 1.1.2.2.1 - title: Ensure /dev/shm is a separate partition (Automated) + title: Ensure /dev/shm is tmpfs or a separate partition (Automated) levels: - l1_server - l1_workstation status: automated - rules: - - partition_for_dev_shm - id: 1.1.2.2.2 title: Ensure nodev option set on /dev/shm partition (Automated) @@ -308,7 +365,7 @@ controls: - ensure_redhat_gpgkey_installed - id: 1.2.1.2 - title: Ensure gpgcheck is globally activated (Automated) + title: Ensure gpgcheck is configured (Automated) levels: - l1_server - l1_workstation @@ -330,6 +387,13 @@ controls: - l1_workstation status: manual + - id: 1.2.1.5 + title: Ensure weak dependencies are configured (Automated) + levels: + - l2_server + - l2_workstation + status: automated + - id: 1.2.2.1 title: Ensure updates, patches, and additional security software are installed (Manual) levels: @@ -427,9 +491,8 @@ controls: levels: - l1_server - l1_workstation - status: pending - notes: |- - This requirement demands a deeper review of the rules. + status: automated + notes: This requirement demands a deeper review of the rules. rules: - file_groupowner_grub2_cfg - file_owner_grub2_cfg @@ -439,27 +502,65 @@ controls: - file_permissions_user_cfg - id: 1.5.1 - title: Ensure address space layout randomization is enabled (Automated) + title: Ensure core file size is configured (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - Address Space Layout Randomization (ASLR) rules: - - sysctl_kernel_randomize_va_space + - disable_users_coredumps - id: 1.5.2 - title: Ensure ptrace_scope is restricted (Automated) + title: Ensure fs.protected_hardlinks is configured (Automated) levels: - l1_server - l1_workstation status: automated - rules: - - sysctl_kernel_yama_ptrace_scope - id: 1.5.3 - title: Ensure core dump backtraces are disabled (Automated) + title: Ensure fs.protected_symlinks is configured (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 1.5.4 + title: Ensure fs.suid_dumpable is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 1.5.5 + title: Ensure kernel.dmesg_restrict is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 1.5.6 + title: Ensure kernel.kptr_restrict is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 1.5.7 + title: Ensure kernel.yama.ptrace_scope is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 1.5.8 + title: Ensure kernel.randomize_va_space is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 1.5.9 + title: Ensure systemd-coredump ProcessSizeMax is configured (Automated) levels: - l1_server - l1_workstation @@ -467,8 +568,8 @@ controls: rules: - coredump_disable_backtraces - - id: 1.5.4 - title: Ensure core dump storage is disabled (Automated) + - id: 1.5.10 + title: Ensure systemd-coredump Storage is configured (Automated) levels: - l1_server - l1_workstation @@ -487,65 +588,36 @@ controls: - var_system_crypto_policy=default_policy - id: 1.6.2 - title: Ensure system wide crypto policy is not set in sshd configuration (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - configure_ssh_crypto_policy - - - id: 1.6.3 title: Ensure system wide crypto policy disables sha1 hash and signature support (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - This requirement is already satisfied by 1.6.1. + notes: This requirement is already satisfied by 1.6.1. related_rules: - configure_crypto_policy - - id: 1.6.4 - title: Ensure system wide crypto policy disables macs less than 128 bits (Automated) + - id: 1.6.3 + title: Ensure system wide crypto policy macs are configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure a module disabling weak MACs in - /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. - related_rules: - - configure_crypto_policy + status: automated - - id: 1.6.5 + - id: 1.6.4 title: Ensure system wide crypto policy disables cbc for ssh (Automated) levels: - l1_server - l1_workstation - status: pending + status: automated notes: |- It is necessary a new rule to ensure a module disabling CBC in /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. related_rules: - configure_crypto_policy - - id: 1.6.6 - title: Ensure system wide crypto policy disables chacha20-poly1305 for ssh (Automated) - levels: - - l1_server - - l1_workstation - status: manual - - - id: 1.6.7 - title: Ensure system wide crypto policy disables EtM for ssh (Automated) - levels: - - l1_server - - l1_workstation - status: manual - - id: 1.7.1 - title: Ensure message of the day is configured properly (Automated) + title: Ensure /etc/motd is configured (Automated) levels: - l1_server - l1_workstation @@ -555,7 +627,7 @@ controls: - cis_banner_text=cis - id: 1.7.2 - title: Ensure local login warning banner is configured properly (Automated) + title: Ensure /etc/issue is configured (Automated) levels: - l1_server - l1_workstation @@ -565,7 +637,7 @@ controls: - cis_banner_text=cis - id: 1.7.3 - title: Ensure remote login warning banner is configured properly (Automated) + title: Ensure /etc/issue.net is configured (Automated) levels: - l1_server - l1_workstation @@ -608,14 +680,6 @@ controls: - file_permissions_etc_issue_net - id: 1.8.1 - title: Ensure GNOME Display Manager is removed (Automated) - levels: - - l2_server - status: automated - rules: - - package_gdm_removed - - - id: 1.8.2 title: Ensure GDM login banner is configured (Automated) levels: - l1_server @@ -626,8 +690,8 @@ controls: - dconf_gnome_login_banner_text - login_banner_text=cis_banners - - id: 1.8.3 - title: Ensure GDM disable-user-list option is enabled (Automated) + - id: 1.8.2 + title: Ensure GDM disable-user-list is configured (Automated) levels: - l1_server - l1_workstation @@ -635,8 +699,8 @@ controls: rules: - dconf_gnome_disable_user_list - - id: 1.8.4 - title: Ensure GDM screen locks when the user is idle (Automated) + - id: 1.8.3 + title: Ensure GDM screen lock is configured (Automated) levels: - l1_server - l1_workstation @@ -647,28 +711,8 @@ controls: - inactivity_timeout_value=15_minutes - var_screensaver_lock_delay=5_seconds - - id: 1.8.5 - title: Ensure GDM screen locks cannot be overridden (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - dconf_gnome_session_idle_user_locks - - dconf_gnome_screensaver_user_locks - - - id: 1.8.6 - title: Ensure GDM automatic mounting of removable media is disabled (Automated) - levels: - - l1_server - - l2_workstation - status: automated - rules: - - dconf_gnome_disable_automount - - dconf_gnome_disable_automount_open - - - id: 1.8.7 - title: Ensure GDM disabling automatic mounting of removable media is not overridden (Automated) + - id: 1.8.4 + title: Ensure GDM automount is configured (Automated) levels: - l1_server - l2_workstation @@ -677,17 +721,8 @@ controls: - dconf_gnome_disable_automount - dconf_gnome_disable_automount_open - - id: 1.8.8 - title: Ensure GDM autorun-never is enabled (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - dconf_gnome_disable_autorun - - - id: 1.8.9 - title: Ensure GDM autorun-never is not overridden (Automated) + - id: 1.8.5 + title: Ensure GDM autorun-never is configured (Automated) levels: - l1_server - l1_workstation @@ -695,18 +730,12 @@ controls: rules: - dconf_gnome_disable_autorun - - id: 1.8.10 - title: Ensure XDMCP is not enabled (Automated) - notes: |- - This was inherited from the RHEL 9 profile. - However, it was reported that XDMCP is no - longer in RHEL 10. + - id: 1.8.6 + title: Ensure Xwayland is configured (Automated) levels: - - l1_server - - l1_workstation + - l2_server + - l2_workstation status: automated - related_rules: - - gnome_gdm_disable_xdmcp - id: 2.1.1 title: Ensure autofs services are not in use (Automated) @@ -729,6 +758,15 @@ controls: - package_avahi_removed - id: 2.1.3 + title: Ensure cockpit web services are not in use (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - service_cockpit_disabled + + - id: 2.1.4 title: Ensure dhcp server services are not in use (Automated) levels: - l1_server @@ -739,7 +777,7 @@ controls: related_rules: - service_dhcpd_disabled - - id: 2.1.4 + - id: 2.1.5 title: Ensure dns server services are not in use (Automated) levels: - l1_server @@ -750,7 +788,7 @@ controls: related_rules: - service_named_disabled - - id: 2.1.5 + - id: 2.1.6 title: Ensure dnsmasq services are not in use (Automated) levels: - l1_server @@ -759,17 +797,6 @@ controls: rules: - package_dnsmasq_removed - - id: 2.1.6 - title: Ensure samba file server services are not in use (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - package_samba_removed - related_rules: - - service_smb_disabled - - id: 2.1.7 title: Ensure ftp server services are not in use (Automated) levels: @@ -792,7 +819,6 @@ controls: - package_cyrus-imapd_removed related_rules: - service_dovecot_disabled - # new rule would be nice to disable cyrus-imapd service - id: 2.1.9 title: Ensure network file system services are not in use (Automated) @@ -809,16 +835,6 @@ controls: - package_nfs-utils_removed - id: 2.1.10 - title: Ensure nis server services are not in use (Automated) - levels: - - l1_server - - l1_workstation - status: automated - related_rules: - - service_ypserv_disabled - - package_ypserv_removed - - - id: 2.1.11 title: Ensure print server services are not in use (Automated) levels: - l1_server @@ -828,7 +844,7 @@ controls: related_rules: - package_cups_removed - - id: 2.1.12 + - id: 2.1.11 title: Ensure rpcbind services are not in use (Automated) levels: - l1_server @@ -842,7 +858,7 @@ controls: related_rules: - package_rpcbind_removed - - id: 2.1.13 + - id: 2.1.12 title: Ensure rsync services are not in use (Automated) levels: - l1_server @@ -853,6 +869,17 @@ controls: related_rules: - service_rsyncd_disabled + - id: 2.1.13 + title: Ensure samba file server services are not in use (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - package_samba_removed + related_rules: + - service_smb_disabled + - id: 2.1.14 title: Ensure snmp services are not in use (Automated) levels: @@ -908,7 +935,14 @@ controls: - package_nginx_removed related_rules: - service_httpd_disabled - # rule would be nice to disable nginx service + + - id: 2.1.19 + title: Ensure GNOME Display Manager is removed (Automated) + levels: + - l2_server + status: automated + rules: + - package_gdm_removed - id: 2.1.20 title: Ensure X window server services are not in use (Automated) @@ -962,15 +996,6 @@ controls: - package_openldap-clients_removed - id: 2.2.3 - title: Ensure nis client is not installed (Automated) - levels: - - l1_server - - l1_workstation - status: automated - related_rules: - - package_ypbind_removed - - - id: 2.2.4 title: Ensure telnet client is not installed (Automated) levels: - l1_server @@ -979,7 +1004,7 @@ controls: rules: - package_telnet_removed - - id: 2.2.5 + - id: 2.2.4 title: Ensure tftp client is not installed (Automated) levels: - l1_server @@ -1005,7 +1030,6 @@ controls: status: automated rules: - chronyd_specify_remote_server - - var_multiple_time_servers=rhel - id: 2.3.3 title: Ensure chrony is not run as the root user (Automated) @@ -1023,11 +1047,10 @@ controls: - l1_workstation status: automated rules: - - package_cron_installed - service_crond_enabled - id: 2.4.1.2 - title: Ensure permissions on /etc/crontab are configured (Automated) + title: Ensure access to /etc/crontab is configured (Automated) levels: - l1_server - l1_workstation @@ -1038,7 +1061,7 @@ controls: - file_permissions_crontab - id: 2.4.1.3 - title: Ensure permissions on /etc/cron.hourly are configured (Automated) + title: Ensure access to /etc/cron.hourly is configured (Automated) levels: - l1_server - l1_workstation @@ -1049,7 +1072,7 @@ controls: - file_permissions_cron_hourly - id: 2.4.1.4 - title: Ensure permissions on /etc/cron.daily are configured (Automated) + title: Ensure access to /etc/cron.daily is configured (Automated) levels: - l1_server - l1_workstation @@ -1060,7 +1083,7 @@ controls: - file_permissions_cron_daily - id: 2.4.1.5 - title: Ensure permissions on /etc/cron.weekly are configured (Automated) + title: Ensure access to /etc/cron.weekly is configured (Automated) levels: - l1_server - l1_workstation @@ -1071,7 +1094,7 @@ controls: - file_permissions_cron_weekly - id: 2.4.1.6 - title: Ensure permissions on /etc/cron.monthly are configured (Automated) + title: Ensure access to /etc/cron.monthly is configured (Automated) levels: - l1_server - l1_workstation @@ -1082,7 +1105,14 @@ controls: - file_permissions_cron_monthly - id: 2.4.1.7 - title: Ensure permissions on /etc/cron.d are configured (Automated) + title: Ensure access to /etc/cron.yearly is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 2.4.1.8 + title: Ensure access to /etc/cron.d is configured (Automated) levels: - l1_server - l1_workstation @@ -1092,8 +1122,8 @@ controls: - file_owner_cron_d - file_permissions_cron_d - - id: 2.4.1.8 - title: Ensure crontab is restricted to authorized users (Automated) + - id: 2.4.1.9 + title: Ensure access to crontab is configured (Automated) levels: - l1_server - l1_workstation @@ -1106,7 +1136,7 @@ controls: - file_permissions_cron_allow - id: 2.4.2.1 - title: Ensure at is restricted to authorized users (Automated) + title: Ensure access to at is configured (Automated) levels: - l1_server - l1_workstation @@ -1128,7 +1158,7 @@ controls: status: manual - id: 3.1.2 - title: Ensure wireless interfaces are disabled (Automated) + title: Ensure wireless interfaces are not available (Automated) levels: - l1_server status: automated @@ -1144,47 +1174,101 @@ controls: rules: - service_bluetooth_disabled + - id: 3.2.1 + title: Ensure atm kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + - id: 3.2.2 + title: Ensure can kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 3.2.3 + title: Ensure dccp kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_dccp_disabled + + - id: 3.2.4 title: Ensure tipc kernel module is not available (Automated) levels: - - l2_server - - l2_workstation + - l1_server + - l1_workstation status: automated rules: - kernel_module_tipc_disabled - - id: 3.2.4 + - id: 3.2.5 + title: Ensure rds kernel module is not available (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - kernel_module_rds_disabled + + - id: 3.2.6 title: Ensure sctp kernel module is not available (Automated) levels: - - l2_server - - l2_workstation + - l1_server + - l1_workstation status: automated rules: - kernel_module_sctp_disabled - - id: 3.3.1 - title: Ensure IP forwarding is disabled (Automated) + - id: 3.3.1.1 + title: Ensure net.ipv4.ip_forward is configured (Automated) levels: - - l1_server - l1_workstation + - l2_server status: automated rules: - sysctl_net_ipv4_ip_forward - - sysctl_net_ipv6_conf_all_forwarding - - sysctl_net_ipv6_conf_all_forwarding_value=disabled - - id: 3.3.2 - title: Ensure packet redirect sending is disabled (Automated) + - id: 3.3.1.2 + title: Ensure net.ipv4.conf.all.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: + - sysctl_net_ipv4_conf_all_forwarding + + - id: 3.3.1.3 + title: Ensure net.ipv4.conf.default.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 3.3.1.4 + title: Ensure net.ipv4.conf.all.send_redirects is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - sysctl_net_ipv4_conf_all_send_redirects + + - id: 3.3.1.5 + title: Ensure net.ipv4.conf.default.send_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_send_redirects - - id: 3.3.3 - title: Ensure bogus icmp responses are ignored (Automated) + - id: 3.3.1.6 + title: Ensure net.ipv4.icmp_ignore_bogus_error_responses is configured (Automated) levels: - l1_server - l1_workstation @@ -1193,8 +1277,8 @@ controls: - sysctl_net_ipv4_icmp_ignore_bogus_error_responses - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled - - id: 3.3.4 - title: Ensure broadcast icmp requests are ignored (Automated) + - id: 3.3.1.7 + title: Ensure net.ipv4.icmp_echo_ignore_broadcasts is configured (Automated) levels: - l1_server - l1_workstation @@ -1203,8 +1287,8 @@ controls: - sysctl_net_ipv4_icmp_echo_ignore_broadcasts - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled - - id: 3.3.5 - title: Ensure icmp redirects are not accepted (Automated) + - id: 3.3.1.8 + title: Ensure net.ipv4.conf.all.accept_redirects is configured (Automated) levels: - l1_server - l1_workstation @@ -1212,15 +1296,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_accept_redirects - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled + + - id: 3.3.1.9 + title: Ensure net.ipv4.conf.default.accept_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_accept_redirects - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled - - sysctl_net_ipv6_conf_all_accept_redirects - - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled - - sysctl_net_ipv6_conf_default_accept_redirects - - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled - - id: 3.3.6 - title: Ensure secure icmp redirects are not accepted (Automated) + - id: 3.3.1.10 + title: Ensure net.ipv4.conf.all.secure_redirects is configured (Automated) levels: - l1_server - l1_workstation @@ -1228,11 +1316,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_secure_redirects - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled + + - id: 3.3.1.11 + title: Ensure net.ipv4.conf.default.secure_redirects is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_secure_redirects - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled - - id: 3.3.7 - title: Ensure reverse path filtering is enabled (Automated) + - id: 3.3.1.12 + title: Ensure net.ipv4.conf.all.rp_filter is configured (Automated) levels: - l1_server - l1_workstation @@ -1240,11 +1336,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_rp_filter - sysctl_net_ipv4_conf_all_rp_filter_value=enabled + + - id: 3.3.1.13 + title: Ensure net.ipv4.conf.default.rp_filter is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_rp_filter - sysctl_net_ipv4_conf_default_rp_filter_value=enabled - - id: 3.3.8 - title: Ensure source routed packets are not accepted (Automated) + - id: 3.3.1.14 + title: Ensure net.ipv4.conf.all.accept_source_route is configured (Automated) levels: - l1_server - l1_workstation @@ -1252,15 +1356,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_accept_source_route - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled + + - id: 3.3.1.15 + title: Ensure net.ipv4.conf.default.accept_source_route is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_accept_source_route - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled - - sysctl_net_ipv6_conf_all_accept_source_route - - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled - - sysctl_net_ipv6_conf_default_accept_source_route - - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled - - id: 3.3.9 - title: Ensure suspicious packets are logged (Automated) + - id: 3.3.1.16 + title: Ensure net.ipv4.conf.all.log_martians is configured (Automated) levels: - l1_server - l1_workstation @@ -1268,11 +1376,19 @@ controls: rules: - sysctl_net_ipv4_conf_all_log_martians - sysctl_net_ipv4_conf_all_log_martians_value=enabled + + - id: 3.3.1.17 + title: Ensure net.ipv4.conf.default.log_martians is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + rules: - sysctl_net_ipv4_conf_default_log_martians - sysctl_net_ipv4_conf_default_log_martians_value=enabled - - id: 3.3.10 - title: Ensure tcp syn cookies is enabled (Automated) + - id: 3.3.1.18 + title: Ensure net.ipv4.tcp_syncookies is configured (Automated) levels: - l1_server - l1_workstation @@ -1281,112 +1397,131 @@ controls: - sysctl_net_ipv4_tcp_syncookies - sysctl_net_ipv4_tcp_syncookies_value=enabled - - id: 3.3.11 - title: Ensure IPv6 router advertisements are not accepted (Automated) + - id: 3.3.2.1 + title: Ensure net.ipv6.conf.all.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 3.3.2.2 + title: Ensure net.ipv6.conf.default.forwarding is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 3.3.2.3 + title: Ensure net.ipv6.conf.all.accept_redirects is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - sysctl_net_ipv6_conf_all_accept_ra - - sysctl_net_ipv6_conf_all_accept_ra_value=disabled - - sysctl_net_ipv6_conf_default_accept_ra - - sysctl_net_ipv6_conf_default_accept_ra_value=disabled + - sysctl_net_ipv6_conf_all_accept_redirects + - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled - - id: 4.1.1 - title: Ensure nftables is installed (Automated) + - id: 3.3.2.4 + title: Ensure net.ipv6.conf.default.accept_redirects is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - package_nftables_installed + - sysctl_net_ipv6_conf_default_accept_redirects + - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled - - id: 4.1.2 - title: Ensure a single firewall configuration utility is in use (Automated) + - id: 3.3.2.5 + title: Ensure net.ipv6.conf.all.accept_source_route is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - service_firewalld_enabled - - package_firewalld_installed - - service_nftables_disabled + - sysctl_net_ipv6_conf_all_accept_source_route + - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled - - id: 4.2.1 - title: Ensure firewalld drops unnecessary services and ports (Manual) + - id: 3.3.2.6 + title: Ensure net.ipv6.conf.default.accept_source_route is configured (Automated) levels: - l1_server - l1_workstation - status: manual - related_rules: - - configure_firewalld_ports + status: automated + rules: + - sysctl_net_ipv6_conf_default_accept_source_route + - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled - - id: 4.2.2 - title: Ensure firewalld loopback traffic is configured (Automated) + - id: 3.3.2.7 + title: Ensure net.ipv6.conf.all.accept_ra is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - firewalld_loopback_traffic_trusted - - firewalld_loopback_traffic_restricted + - sysctl_net_ipv6_conf_all_accept_ra + - sysctl_net_ipv6_conf_all_accept_ra_value=disabled - - id: 4.3.1 - title: Ensure nftables base chains exist (Automated) + - id: 3.3.2.8 + title: Ensure net.ipv6.conf.default.accept_ra is configured (Automated) levels: - l1_server - l1_workstation - status: supported - notes: |- - RHEL systems use firewalld for firewall management. Although nftables is the default - back-end for firewalld, it is not recommended to use nftables directly when firewalld - is in use. When using firewalld the base chains are installed by default. - related_rules: - - set_nftables_base_chain - - var_nftables_table=firewalld - - var_nftables_family=inet - - var_nftables_base_chain_names=chain_names - - var_nftables_base_chain_types=chain_types - - var_nftables_base_chain_hooks=chain_hooks - - var_nftables_base_chain_priorities=chain_priorities - - var_nftables_base_chain_policies=chain_policies + status: automated + rules: + - sysctl_net_ipv6_conf_default_accept_ra + - sysctl_net_ipv6_conf_default_accept_ra_value=disabled + + - id: 4.1.1 + title: Ensure firewalld is installed (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 4.1.2 + title: Ensure firewalld backend is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 4.1.3 + title: Ensure firewalld.service is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated - - id: 4.3.2 - title: Ensure nftables established connections are configured (Manual) + - id: 4.1.4 + title: Ensure firewalld active zone target is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + + - id: 4.1.5 + title: Ensure firewalld loopback traffic is configured (Manual) levels: - l1_server - l1_workstation status: manual - - id: 4.3.3 - title: Ensure nftables default deny firewall policy (Automated) + - id: 4.1.6 + title: Ensure firewalld loopback source address traffic is configured (Manual) levels: - l1_server - l1_workstation - status: supported - notes: |- - RHEL systems use firewalld for firewall management. Although nftables is the default - back-end for firewalld, it is not recommended to use nftables directly when firewalld - is in use. - related_rules: - - nftables_ensure_default_deny_policy + status: manual - - id: 4.3.4 - title: Ensure nftables loopback traffic is configured (Automated) + - id: 4.1.7 + title: Ensure firewalld services and ports are configured (Manual) levels: - l1_server - l1_workstation - status: supported - notes: |- - RHEL systems use firewalld for firewall management. Although nftables is the default - back-end for firewalld, it is not recommended to use nftables directly when firewalld - is in use. - related_rules: - - set_nftables_loopback_traffic + status: manual - id: 5.1.1 - title: Ensure permissions on /etc/ssh/sshd_config are configured (Automated) + title: Ensure access to /etc/ssh/sshd_config is configured (Automated) levels: - l1_server - l1_workstation @@ -1397,87 +1532,61 @@ controls: - file_permissions_sshd_config - id: 5.1.2 - title: Ensure permissions on SSH private host key files are configured (Automated) + title: Ensure access to SSH private host key files is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - file_permissions_sshd_private_key - - file_ownership_sshd_private_key - file_groupownership_sshd_private_key + - file_ownership_sshd_private_key + - file_permissions_sshd_private_key - id: 5.1.3 - title: Ensure permissions on SSH public host key files are configured (Automated) + title: Ensure access to SSH public host key files is configured (Automated) levels: - l1_server - l1_workstation status: automated rules: - - file_permissions_sshd_pub_key - - file_ownership_sshd_pub_key - file_groupownership_sshd_pub_key + - file_ownership_sshd_pub_key + - file_permissions_sshd_pub_key - id: 5.1.4 - title: Ensure sshd Ciphers are configured (Automated) + title: Ensure sshd access is configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - The status was automated but we need to double check the approach used in this rule. - Therefore I moved it to pending until deeper investigation. - related_rules: - - sshd_use_approved_ciphers - - sshd_approved_ciphers=cis_rhel8 + status: automated + rules: + - sshd_limit_user_access - id: 5.1.5 - title: Ensure sshd KexAlgorithms is configured (Automated) + title: Ensure sshd Banner is configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - The status was automated but we need to double check the approach used in this rule. - Therefore I moved it to pending until deeper investigation. + status: automated rules: - - sshd_use_strong_kex - - sshd_strong_kex=cis_rhel8 + - sshd_enable_warning_banner_net + related_rules: + - sshd_enable_warning_banner - id: 5.1.6 - title: Ensure sshd MACs are configured (Automated) + title: Ensure sshd Ciphers are configured (Automated) levels: - l1_server - l1_workstation - status: pending + status: automated notes: |- The status was automated but we need to double check the approach used in this rule. Therefore I moved it to pending until deeper investigation. - rules: - - sshd_use_strong_macs - - sshd_strong_macs=cis_rhel8 - - - id: 5.1.7 - title: Ensure sshd access is configured (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - sshd_limit_user_access - - - id: 5.1.8 - title: Ensure sshd Banner is configured (Automated) - levels: - - l1_server - - l1_workstation - status: automated - rules: - - sshd_enable_warning_banner_net related_rules: - - sshd_enable_warning_banner + - sshd_use_approved_ciphers + - sshd_approved_ciphers=cis_rhel8 - - id: 5.1.9 + - id: 5.1.7 title: Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured (Automated) levels: - l1_server @@ -1487,33 +1596,34 @@ controls: The requirement gives an example of 45 seconds, but is flexible about the values. It is only necessary to ensure there is a timeout configured in alignment to the site policy. rules: - - sshd_idle_timeout_value=5_minutes - sshd_set_idle_timeout + - sshd_idle_timeout_value=5_minutes - sshd_set_keepalive - var_sshd_set_keepalive=1 - - id: 5.1.10 + - id: 5.1.8 title: Ensure sshd DisableForwarding is enabled (Automated) levels: - - l2_server - l1_workstation - status: pending - notes: |- - New templated rule is necessary for "disableforwarding" option. + - l2_server + status: automated + notes: New templated rule is necessary for "disableforwarding" option. related_rules: - sshd_disable_tcp_forwarding - sshd_disable_x11_forwarding + rules: + - sshd_disable_forwarding - - id: 5.1.11 + - id: 5.1.9 title: Ensure sshd GSSAPIAuthentication is disabled (Automated) levels: - - l2_server - l1_workstation + - l2_server status: automated rules: - sshd_disable_gssapi_auth - - id: 5.1.12 + - id: 5.1.10 title: Ensure sshd HostbasedAuthentication is disabled (Automated) levels: - l1_server @@ -1522,16 +1632,29 @@ controls: rules: - disable_host_auth - - id: 5.1.13 + - id: 5.1.11 title: Ensure sshd IgnoreRhosts is enabled (Automated) levels: - l1_server - l1_workstation status: automated rules: - - sshd_disable_rhosts + - sshd_disable_rhosts + + - id: 5.1.12 + title: Ensure sshd KexAlgorithms is configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + notes: |- + The status was automated but we need to double check the approach used in this rule. + Therefore I moved it to pending until deeper investigation. + rules: + - sshd_use_strong_kex + - sshd_strong_kex=cis_rhel8 - - id: 5.1.14 + - id: 5.1.13 title: Ensure sshd LoginGraceTime is configured (Automated) levels: - l1_server @@ -1541,7 +1664,7 @@ controls: - sshd_set_login_grace_time - var_sshd_set_login_grace_time=60 - - id: 5.1.15 + - id: 5.1.14 title: Ensure sshd LogLevel is configured (Automated) levels: - l1_server @@ -1556,6 +1679,19 @@ controls: related_rules: - sshd_set_loglevel_info + - id: 5.1.15 + title: Ensure sshd MACs are configured (Automated) + levels: + - l1_server + - l1_workstation + status: automated + notes: |- + The status was automated but we need to double check the approach used in this rule. + Therefore I moved it to pending until deeper investigation. + rules: + - sshd_use_strong_macs + - sshd_strong_macs=cis_rhel8 + - id: 5.1.16 title: Ensure sshd MaxAuthTries is configured (Automated) levels: @@ -1563,8 +1699,8 @@ controls: - l1_workstation status: automated rules: - - sshd_max_auth_tries_value=4 - sshd_set_max_auth_tries + - sshd_max_auth_tries_value=4 - id: 5.1.17 title: Ensure sshd MaxStartups is configured (Automated) @@ -1665,10 +1801,10 @@ controls: - l1_workstation status: automated rules: - - sudo_require_reauthentication + - sudo_require_authentication - id: 5.2.6 - title: Ensure sudo authentication timeout is configured correctly (Automated) + title: Ensure sudo timestamp_timeout is configured (Automated) levels: - l1_server - l1_workstation @@ -1693,35 +1829,6 @@ controls: - ensure_pam_wheel_group_empty - id: 5.3.1.1 - title: Ensure latest version of pam is installed (Automated) - levels: - - l1_server - - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure PAM package is updated. - - - id: 5.3.1.2 - title: Ensure latest version of authselect is installed (Automated) - levels: - - l1_server - - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure authselect package is updated. - - - id: 5.3.1.3 - title: Ensure latest version of libpwquality is installed (Automated) - levels: - - l1_server - - l1_workstation - status: pending - notes: |- - It is necessary a new rule to ensure libpwquality package is updated. - rules: - - package_pam_pwquality_installed - - - id: 5.3.2.1 title: Ensure active authselect profile includes pam modules (Automated) levels: - l1_server @@ -1736,30 +1843,28 @@ controls: related_rules: - no_empty_passwords - - id: 5.3.2.2 + - id: 5.3.1.2 title: Ensure pam_faillock module is enabled (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - This requirement is also indirectly satisfied by the requirement 5.3.3.1. + notes: This requirement is also indirectly satisfied by the requirement 5.3.3.1. rules: - account_password_pam_faillock_password_auth - account_password_pam_faillock_system_auth - - id: 5.3.2.3 + - id: 5.3.1.3 title: Ensure pam_pwquality module is enabled (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - This requirement is also indirectly satisfied by the requirement 5.3.3.2. + notes: This requirement is also indirectly satisfied by the requirement 5.3.3.2. related_rules: - package_pam_pwquality_installed - - id: 5.3.2.4 + - id: 5.3.1.4 title: Ensure pam_pwhistory module is enabled (Automated) levels: - l1_server @@ -1767,12 +1872,12 @@ controls: status: automated notes: |- The module is properly enabled by the rules mentioned in related_rules. - Requirements in 5.3.3.3 use these rules. + Requirements in 5.3.2.3 use these rules. related_rules: - accounts_password_pam_pwhistory_remember_password_auth - accounts_password_pam_pwhistory_remember_system_auth - - id: 5.3.2.5 + - id: 5.3.1.5 title: Ensure pam_unix module is enabled (Automated) levels: - l1_server @@ -1785,7 +1890,7 @@ controls: related_rules: - no_empty_passwords - - id: 5.3.3.1.1 + - id: 5.3.2.1.1 title: Ensure password failed attempts lockout is configured (Automated) levels: - l1_server @@ -1793,9 +1898,8 @@ controls: status: automated rules: - accounts_passwords_pam_faillock_deny - - var_accounts_passwords_pam_faillock_deny=5 - - id: 5.3.3.1.2 + - id: 5.3.2.1.2 title: Ensure password unlock time is configured (Automated) levels: - l1_server @@ -1807,9 +1911,8 @@ controls: attack to legitimate users. rules: - accounts_passwords_pam_faillock_unlock_time - - var_accounts_passwords_pam_faillock_unlock_time=900 - - id: 5.3.3.1.3 + - id: 5.3.2.1.3 title: Ensure password failed attempts lockout includes root account (Automated) levels: - l2_server @@ -1818,7 +1921,7 @@ controls: rules: - accounts_passwords_pam_faillock_deny_root - - id: 5.3.3.2.1 + - id: 5.3.2.2.1 title: Ensure password number of changed characters is configured (Automated) levels: - l1_server @@ -1826,9 +1929,8 @@ controls: status: automated rules: - accounts_password_pam_difok - - var_password_pam_difok=2 - - id: 5.3.3.2.2 + - id: 5.3.2.2.2 title: Ensure password length is configured (Automated) levels: - l1_server @@ -1836,30 +1938,28 @@ controls: status: automated rules: - accounts_password_pam_minlen - - var_password_pam_minlen=14 - - id: 5.3.3.2.3 + - id: 5.3.2.2.3 title: Ensure password complexity is configured (Manual) levels: - l1_server - l1_workstation - status: automated + status: manual notes: |- This requirement is expected to be manual. However, in previous versions of the policy it was already automated the configuration of "minclass" option. This posture was kept for - RHEL 9 in this new version. Rules related to other options are informed in related_rules. + RHEL 10 in this new version. Rules related to other options are informed in related_rules. In short, minclass=4 alone can achieve the same result achieved by the combination of the other 4 options mentioned in the policy. - rules: - - accounts_password_pam_minclass - - var_password_pam_minclass=4 related_rules: - accounts_password_pam_dcredit - accounts_password_pam_lcredit - accounts_password_pam_ocredit - accounts_password_pam_ucredit + rules: + - accounts_password_pam_minclass - - id: 5.3.3.2.4 + - id: 5.3.2.2.4 title: Ensure password same consecutive characters is configured (Automated) levels: - l1_server @@ -1867,18 +1967,16 @@ controls: status: automated rules: - accounts_password_pam_maxrepeat - - var_password_pam_maxrepeat=3 - - id: 5.3.3.2.5 + - id: 5.3.2.2.5 title: Ensure password maximum sequential characters is configured (Automated) levels: - l1_server - l1_workstation - status: planned - notes: |- - A new templated rule and variable are necessary for the maxsequence option. + status: automated + notes: A new templated rule and variable are necessary for the maxsequence option. - - id: 5.3.3.2.6 + - id: 5.3.2.2.6 title: Ensure password dictionary check is enabled (Automated) levels: - l1_server @@ -1886,9 +1984,8 @@ controls: status: automated rules: - accounts_password_pam_dictcheck - - var_password_pam_dictcheck=1 - - id: 5.3.3.2.7 + - id: 5.3.2.2.7 title: Ensure password quality is enforced for the root user (Automated) levels: - l1_server @@ -1897,7 +1994,7 @@ controls: rules: - accounts_password_pam_enforce_root - - id: 5.3.3.3.1 + - id: 5.3.2.3.1 title: Ensure password history remember is configured (Automated) levels: - l1_server @@ -1910,52 +2007,49 @@ controls: rules: - accounts_password_pam_pwhistory_remember_password_auth - accounts_password_pam_pwhistory_remember_system_auth - - var_password_pam_remember_control_flag=requisite_or_required - - var_password_pam_remember=24 related_rules: - accounts_password_pam_retry - - id: 5.3.3.3.2 + - id: 5.3.2.3.2 title: Ensure password history is enforced for the root user (Automated) levels: - l1_server - l1_workstation - status: planned + status: automated notes: |- A new rule needs to be created to check and remediate the enforce_for_root option in /etc/security/pwhistory.conf. accounts_password_pam_enforce_root can be used as reference. - - id: 5.3.3.3.3 + - id: 5.3.2.3.3 title: Ensure pam_pwhistory includes use_authtok (Automated) levels: - l1_server - l1_workstation status: partial notes: |- - In RHEL 9 pam_pwhistory is enabled via authselect feature, as required in 5.3.2.4. The + In RHEL 10 pam_pwhistory is enabled via authselect feature, as required in 5.3.1.4. The feature automatically set "use_authok" option. In any case, we don't have a rule to check this option specifically. related_rules: - accounts_password_pam_pwhistory_remember_password_auth - accounts_password_pam_pwhistory_remember_system_auth - - id: 5.3.3.4.1 + - id: 5.3.2.4.1 title: Ensure pam_unix does not include nullok (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - The rule more specifically used in this requirement also satify the requirement 5.3.2.5. + notes: The rule more specifically used in this requirement also satify the requirement 5.3.1.5. rules: - no_empty_passwords - - id: 5.3.3.4.2 + - id: 5.3.2.4.2 title: Ensure pam_unix does not include remember (Automated) levels: - l1_server - l1_workstation - status: pending + status: automated notes: |- Usage of pam_unix.so module together with "remember" option is deprecated and is not recommened by this policy. Instead, it should be used remember option of pam_pwhistory @@ -1963,29 +2057,27 @@ controls: https://bugzilla.redhat.com/show_bug.cgi?id=1778929 A new rule needs to be created to remove the remember option from pam_unix module. - - id: 5.3.3.4.3 + - id: 5.3.2.4.3 title: Ensure pam_unix includes a strong password hashing algorithm (Automated) levels: - l1_server - l1_workstation status: automated - notes: |- - Changes in logindefs mentioned in this requirement are more specifically covered by 5.4.1.4 + notes: Changes in logindefs mentioned in this requirement are more specifically covered by 5.4.1.4 rules: - set_password_hashing_algorithm_systemauth - set_password_hashing_algorithm_passwordauth - - var_password_hashing_algorithm_pam=yescrypt - - id: 5.3.3.4.4 + - id: 5.3.2.4.4 title: Ensure pam_unix includes use_authtok (Automated) levels: - l1_server - l1_workstation status: partial notes: |- - In RHEL 9 pam_unix is enabled by default in all authselect profiles already with the + In RHEL 10 pam_unix is enabled by default in all authselect profiles already with the use_authtok option set. In any case, we don't have a rule to check this option specifically, - like in 5.3.3.3.3. + like in 5.3.2.3.3. - id: 5.4.1.1 title: Ensure password expiration is configured (Automated) @@ -1995,18 +2087,16 @@ controls: status: automated rules: - accounts_maximum_age_login_defs - - var_accounts_maximum_age_login_defs=365 - accounts_password_set_max_life_existing - id: 5.4.1.2 - title: Ensure minimum password days is configured (Automated) + title: Ensure minimum password days is configured (Manual) levels: - l2_server - l2_workstation - status: automated + status: manual rules: - accounts_minimum_age_login_defs - - var_accounts_minimum_age_login_defs=1 - accounts_password_set_min_life_existing - id: 5.4.1.3 @@ -2017,7 +2107,6 @@ controls: status: automated rules: - accounts_password_warn_age_login_defs - - var_accounts_password_warn_age_login_defs=7 - accounts_password_set_warn_age_existing - id: 5.4.1.4 @@ -2032,8 +2121,6 @@ controls: rules: - set_password_hashing_algorithm_libuserconf - set_password_hashing_algorithm_logindefs - - var_password_hashing_algorithm=yescrypt - - var_password_hashing_algorithm_pam=yescrypt - id: 5.4.1.5 title: Ensure inactive password lock is configured (Automated) @@ -2044,7 +2131,6 @@ controls: rules: - account_disable_post_pw_expiration - accounts_set_post_pw_existing - - var_account_disable_post_pw_expiration=30 - id: 5.4.1.6 title: Ensure all users last password change date is in the past (Automated) @@ -2082,9 +2168,8 @@ controls: levels: - l1_server - l1_workstation - status: pending - notes: |- - New rule is necessary. + status: automated + notes: New rule is necessary. - id: 5.4.2.4 title: Ensure root account access is controlled (Automated) @@ -2110,7 +2195,7 @@ controls: levels: - l1_server - l1_workstation - status: pending + status: automated notes: |- There is no rule to ensure umask in /root/.bash_profile and /root/.bashrc. A new rule have to be created. It can be based on accounts_umask_interactive_users. @@ -2130,16 +2215,15 @@ controls: levels: - l1_server - l1_workstation - status: pending - notes: |- - New rule is necessary. + status: automated + notes: New rule is necessary. - id: 5.4.3.1 title: Ensure nologin is not listed in /etc/shells (Automated) levels: - l2_server - l2_workstation - status: pending + status: automated notes: |- It is necessary to create a new rule to check and remove nologin from /etc/shells. The no_tmux_in_shells rule can be used as referece. @@ -2152,7 +2236,6 @@ controls: status: automated rules: - accounts_tmout - - var_accounts_tmout=15_min - id: 5.4.3.3 title: Ensure default user umask is configured (Automated) @@ -2164,7 +2247,6 @@ controls: - accounts_umask_etc_bashrc - accounts_umask_etc_login_defs - accounts_umask_etc_profile - - var_accounts_user_umask=027 - id: 6.1.1 title: Ensure AIDE is installed (Automated) @@ -2197,7 +2279,7 @@ controls: - aide_use_fips_hashes - id: 6.2.1.1 - title: Ensure journald service is enabled and active (Automated) + title: Ensure journald service is active (Automated) levels: - l1_server - l1_workstation @@ -2224,80 +2306,70 @@ controls: levels: - l1_server - l1_workstation - status: pending + status: automated notes: |- It is necessary to create a new rule to check the status of journald and rsyslog. It would also be necessary a new rule to disable or remove rsyslog. - - id: 6.2.2.1.1 - title: Ensure systemd-journal-remote is installed (Automated) + - id: 6.2.2.2 + title: Ensure journald ForwardToSyslog is disabled (Automated) levels: - l1_server - l1_workstation status: automated - rules: - - package_systemd-journal-remote_installed + notes: This rule conflicts with 6.2.3.3. More investigation is needed to properly solve this. + related_rules: + - journald_forward_to_syslog - - id: 6.2.2.1.2 - title: Ensure systemd-journal-upload authentication is configured (Manual) + - id: 6.2.2.3 + title: Ensure journald Compress is configured (Automated) levels: - l1_server - l1_workstation - status: manual + status: automated - - id: 6.2.2.1.3 - title: Ensure systemd-journal-upload is enabled and active (Automated) + - id: 6.2.2.4 + title: Ensure journald Storage is configured (Automated) levels: - l1_server - l1_workstation - status: pending - notes: |- - New templated rule is necessary. + status: automated - - id: 6.2.2.1.4 - title: Ensure systemd-journal-remote service is not in use (Automated) + - id: 6.2.2.1.1 + title: Ensure systemd-journal-remote is installed (Automated) levels: - l1_server - l1_workstation status: automated - rules: - - socket_systemd-journal-remote_disabled - - id: 6.2.2.2 - title: Ensure journald ForwardToSyslog is disabled (Automated) + - id: 6.2.2.1.2 + title: Ensure systemd-journal-upload authentication is configured (Manual) levels: - l1_server - l1_workstation - status: pending - notes: |- - This rule conflicts with 6.2.3.3. More investigation is needed to properly solve this. - related_rules: - - journald_forward_to_syslog + status: manual - - id: 6.2.2.3 - title: Ensure journald Compress is configured (Automated) + - id: 6.2.2.1.3 + title: Ensure systemd-journal-upload is enabled and active (Automated) levels: - l1_server - l1_workstation status: automated - rules: - - journald_compress + notes: New templated rule is necessary. - - id: 6.2.2.4 - title: Ensure journald Storage is configured (Automated) + - id: 6.2.2.1.4 + title: Ensure systemd-journal-remote service is not in use (Automated) levels: - l1_server - l1_workstation status: automated - rules: - - journald_storage - id: 6.2.3.1 title: Ensure rsyslog is installed (Automated) levels: - l1_server - l1_workstation - status: supported + status: automated related_rules: - package_rsyslog_installed @@ -2306,7 +2378,7 @@ controls: levels: - l1_server - l1_workstation - status: supported + status: automated related_rules: - service_rsyslog_enabled @@ -2315,7 +2387,7 @@ controls: levels: - l1_server - l1_workstation - status: supported + status: automated related_rules: - journald_forward_to_syslog @@ -2324,7 +2396,7 @@ controls: levels: - l1_server - l1_workstation - status: supported + status: automated related_rules: - rsyslog_filecreatemode @@ -2349,7 +2421,7 @@ controls: levels: - l1_server - l1_workstation - status: supported + status: automated related_rules: - rsyslog_nolisten @@ -2370,8 +2442,7 @@ controls: - l1_server - l1_workstation status: automated - notes: |- - It is not harmful to run these rules even if rsyslog is not installed or active. + notes: It is not harmful to run these rules even if rsyslog is not installed or active. rules: - rsyslog_files_groupownership - rsyslog_files_ownership @@ -2397,7 +2468,7 @@ controls: - grub2_audit_argument - id: 6.3.1.3 - title: Ensure audit_backlog_limit is sufficient (Automated) + title: Ensure audit_backlog_limit is configured (Automated) levels: - l2_server - l2_workstation @@ -2422,7 +2493,6 @@ controls: status: automated rules: - auditd_data_retention_max_log_file - - var_auditd_max_log_file=6 - id: 6.3.2.2 title: Ensure audit logs are not automatically deleted (Automated) @@ -2432,7 +2502,6 @@ controls: status: automated rules: - auditd_data_retention_max_log_file_action - - var_auditd_max_log_file_action=keep_logs - id: 6.3.2.3 title: Ensure system is disabled when audit logs are full (Automated) @@ -2443,8 +2512,6 @@ controls: rules: - auditd_data_disk_error_action - auditd_data_disk_full_action - - var_auditd_disk_error_action=cis_rhel8 - - var_auditd_disk_full_action=cis_rhel8 - id: 6.3.2.4 title: Ensure system warns when audit logs are low on space (Automated) @@ -2453,21 +2520,15 @@ controls: - l2_workstation status: automated rules: - - auditd_data_retention_action_mail_acct - auditd_data_retention_admin_space_left_action - auditd_data_retention_space_left_action - - var_auditd_action_mail_acct=root - - var_auditd_admin_space_left_action=cis_rhel8 - - var_auditd_space_left_action=cis_rhel8 - id: 6.3.3.1 - title: Ensure changes to system administration scope (sudoers) is collected (Automated) + title: Ensure modification of the /etc/sudoers file is collected (Automated) levels: - l2_server - l2_workstation status: automated - rules: - - audit_rules_sysadmin_actions - id: 6.3.3.2 title: Ensure actions as another user are always logged (Automated) @@ -2502,18 +2563,41 @@ controls: - audit_rules_time_stime - id: 6.3.3.5 - title: Ensure events that modify the system's network environment are collected (Automated) + title: Ensure events that modify sethostname and setdomainname are collected (Automated) levels: - l2_server - l2_workstation - status: partial - notes: |- - These rules are not covering "/etc/hostname" and "/etc/NetworkManager/". - rules: - - audit_rules_networkconfig_modification - - audit_rules_networkconfig_modification_network_scripts + status: automated - id: 6.3.3.6 + title: Ensure events that modify /etc/issue and /etc/issue.net are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.7 + title: Ensure events that modify /etc/hosts and /etc/hostname are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.8 + title: Ensure events that modify /etc/sysconfig/network and /etc/sysconfig/network-scripts/ are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.9 + title: Ensure events that modify /etc/NetworkManager directory are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.10 title: Ensure use of privileged commands are collected (Automated) levels: - l2_server @@ -2522,7 +2606,7 @@ controls: rules: - audit_rules_privileged_commands - - id: 6.3.3.7 + - id: 6.3.3.11 title: Ensure unsuccessful file access attempts are collected (Automated) levels: - l2_server @@ -2535,44 +2619,87 @@ controls: - audit_rules_unsuccessful_file_modification_openat - audit_rules_unsuccessful_file_modification_truncate - - id: 6.3.3.8 - title: Ensure events that modify user/group information are collected (Automated) + - id: 6.3.3.12 + title: Ensure events that modify /etc/group information are collected (Automated) levels: - l2_server - l2_workstation - status: partial - notes: |- - Missing rules to check "/etc/nsswitch.conf", "/etc/pam.conf" and "/etc/pam.d" - rules: - - audit_rules_usergroup_modification_group - - audit_rules_usergroup_modification_gshadow - - audit_rules_usergroup_modification_opasswd - - audit_rules_usergroup_modification_passwd - - audit_rules_usergroup_modification_shadow + status: automated - - id: 6.3.3.9 - title: Ensure discretionary access control permission modification events are collected (Automated) + - id: 6.3.3.13 + title: Ensure events that modify /etc/passwd information are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.14 + title: Ensure events that modify /etc/shadow and /etc/gshadow are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.15 + title: Ensure events that modify /etc/security/opasswd are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.16 + title: Ensure events that modify /etc/nsswitch.conf file are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.17 + title: Ensure events that modify /etc/pam.conf and /etc/pam.d/ information are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.18 + title: Ensure discretionary access control permission modification events chmod,fchmod,fchmodat,fchmodat2 are collected (Automated) levels: - l2_server - l2_workstation status: automated rules: - audit_rules_dac_modification_chmod - - audit_rules_dac_modification_chown - audit_rules_dac_modification_fchmod - audit_rules_dac_modification_fchmodat - audit_rules_dac_modification_fchmodat2 + + - id: 6.3.3.19 + title: Ensure discretionary access control permission modification events chown,fchown,lchown,fchownat are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: + - audit_rules_dac_modification_chown - audit_rules_dac_modification_fchown - audit_rules_dac_modification_fchownat + - audit_rules_dac_modification_lchown + + - id: 6.3.3.20 + title: Ensure discretionary access control permission modification events setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + rules: - audit_rules_dac_modification_fremovexattr - audit_rules_dac_modification_fsetxattr - - audit_rules_dac_modification_lchown - audit_rules_dac_modification_lremovexattr - audit_rules_dac_modification_lsetxattr - audit_rules_dac_modification_removexattr - audit_rules_dac_modification_setxattr - - id: 6.3.3.10 + - id: 6.3.3.21 title: Ensure successful file system mounts are collected (Automated) levels: - l2_server @@ -2581,7 +2708,7 @@ controls: rules: - audit_rules_media_export - - id: 6.3.3.11 + - id: 6.3.3.22 title: Ensure session initiation information is collected (Automated) levels: - l2_server @@ -2592,7 +2719,7 @@ controls: - audit_rules_session_events_btmp - audit_rules_session_events_wtmp - - id: 6.3.3.12 + - id: 6.3.3.23 title: Ensure login and logout events are collected (Automated) levels: - l2_server @@ -2601,22 +2728,22 @@ controls: rules: - audit_rules_login_events_faillock - audit_rules_login_events_lastlog - - var_accounts_passwords_pam_faillock_dir=run - - id: 6.3.3.13 - title: Ensure file deletion events by users are collected (Automated) + - id: 6.3.3.24 + title: Ensure unlink file deletion events by users are collected (Automated) levels: - l2_server - l2_workstation status: automated - rules: - - audit_rules_file_deletion_events_rename - - audit_rules_file_deletion_events_renameat - - audit_rules_file_deletion_events_renameat2 - - audit_rules_file_deletion_events_unlink - - audit_rules_file_deletion_events_unlinkat - - id: 6.3.3.14 + - id: 6.3.3.25 + title: Ensure rename file deletion events by users are collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.26 title: Ensure events that modify the system's Mandatory Access Controls are collected (Automated) levels: - l2_server @@ -2626,7 +2753,7 @@ controls: - audit_rules_mac_modification_etc_selinux - audit_rules_mac_modification_usr_share - - id: 6.3.3.15 + - id: 6.3.3.27 title: Ensure successful and unsuccessful attempts to use the chcon command are collected (Automated) levels: - l2_server @@ -2635,7 +2762,7 @@ controls: rules: - audit_rules_execution_chcon - - id: 6.3.3.16 + - id: 6.3.3.28 title: Ensure successful and unsuccessful attempts to use the setfacl command are collected (Automated) levels: - l2_server @@ -2644,7 +2771,7 @@ controls: rules: - audit_rules_execution_setfacl - - id: 6.3.3.17 + - id: 6.3.3.29 title: Ensure successful and unsuccessful attempts to use the chacl command are collected (Automated) levels: - l2_server @@ -2653,7 +2780,7 @@ controls: rules: - audit_rules_execution_chacl - - id: 6.3.3.18 + - id: 6.3.3.30 title: Ensure successful and unsuccessful attempts to use the usermod command are collected (Automated) levels: - l2_server @@ -2662,7 +2789,7 @@ controls: rules: - audit_rules_privileged_commands_usermod - - id: 6.3.3.19 + - id: 6.3.3.31 title: Ensure kernel module loading unloading and modification is collected (Automated) levels: - l2_server @@ -2675,7 +2802,35 @@ controls: - audit_rules_kernel_module_loading_query - audit_rules_privileged_commands_kmod - - id: 6.3.3.20 + - id: 6.3.3.32 + title: Ensure kernel "init_module" and "finit_module" loading unloading and modification is collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.33 + title: Ensure kernel "delete_module" loading unloading and modification is collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.34 + title: Ensure kernel "create_module" and "query_module" loading unloading and modification is collected (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.35 + title: Ensure the audit configuration is loaded regardless of errors (Automated) + levels: + - l2_server + - l2_workstation + status: automated + + - id: 6.3.3.36 title: Ensure the audit configuration is immutable (Automated) levels: - l2_server @@ -2684,7 +2839,7 @@ controls: rules: - audit_rules_immutable - - id: 6.3.3.21 + - id: 6.3.3.37 title: Ensure the running and on disk configuration is the same (Manual) levels: - l2_server @@ -2782,7 +2937,7 @@ controls: - file_groupownership_audit_binaries - id: 7.1.1 - title: Ensure permissions on /etc/passwd are configured (Automated) + title: Ensure access to /etc/passwd is configured (Automated) levels: - l1_server - l1_workstation @@ -2793,7 +2948,7 @@ controls: - file_permissions_etc_passwd - id: 7.1.2 - title: Ensure permissions on /etc/passwd- are configured (Automated) + title: Ensure access to /etc/passwd- is configured (Automated) levels: - l1_server - l1_workstation @@ -2804,7 +2959,7 @@ controls: - file_permissions_backup_etc_passwd - id: 7.1.3 - title: Ensure permissions on /etc/group are configured (Automated) + title: Ensure access to /etc/group is configured (Automated) levels: - l1_server - l1_workstation @@ -2815,7 +2970,7 @@ controls: - file_permissions_etc_group - id: 7.1.4 - title: Ensure permissions on /etc/group- are configured (Automated) + title: Ensure access to /etc/group- is configured (Automated) levels: - l1_server - l1_workstation @@ -2826,7 +2981,7 @@ controls: - file_permissions_backup_etc_group - id: 7.1.5 - title: Ensure permissions on /etc/shadow are configured (Automated) + title: Ensure access to /etc/shadow is configured (Automated) levels: - l1_server - l1_workstation @@ -2837,7 +2992,7 @@ controls: - file_permissions_etc_shadow - id: 7.1.6 - title: Ensure permissions on /etc/shadow- are configured (Automated) + title: Ensure access to /etc/shadow- is configured (Automated) levels: - l1_server - l1_workstation @@ -2848,7 +3003,7 @@ controls: - file_permissions_backup_etc_shadow - id: 7.1.7 - title: Ensure permissions on /etc/gshadow are configured (Automated) + title: Ensure access to /etc/gshadow is configured (Automated) levels: - l1_server - l1_workstation @@ -2859,7 +3014,7 @@ controls: - file_permissions_etc_gshadow - id: 7.1.8 - title: Ensure permissions on /etc/gshadow- are configured (Automated) + title: Ensure access to /etc/gshadow- is configured (Automated) levels: - l1_server - l1_workstation @@ -2870,7 +3025,7 @@ controls: - file_permissions_backup_etc_gshadow - id: 7.1.9 - title: Ensure permissions on /etc/shells are configured (Automated) + title: Ensure access to /etc/shells is configured (Automated) levels: - l1_server - l1_workstation @@ -2881,13 +3036,12 @@ controls: - file_permissions_etc_shells - id: 7.1.10 - title: Ensure permissions on /etc/security/opasswd are configured (Automated) + title: Ensure access to /etc/security/opasswd is configured (Automated) levels: - l1_server - l1_workstation - status: partial + status: automated rules: - # TODO: We need another rule that checks /etc/security/opasswd.old - file_etc_security_opasswd - id: 7.1.11 @@ -2906,8 +3060,8 @@ controls: - l1_server - l1_workstation status: partial - rules: # TODO: add rules for unowned/ungrouped directories + rules: - no_files_unowned_by_user - file_permissions_ungroupowned @@ -2921,16 +3075,6 @@ controls: - file_permissions_unauthorized_suid - file_permissions_unauthorized_sgid - - id: 7.1.14 - title: Audit system file permissions (Manual) - levels: - - l2_server - - l2_workstation - status: manual - related_rules: - - rpm_verify_permissions - - rpm_verify_ownership - - id: 7.2.1 title: Ensure accounts in /etc/passwd use shadowed passwords (Automated) levels: @@ -3012,15 +3156,13 @@ controls: levels: - l1_server - l1_workstation - notes: |- - Missing a rule to check that .bash_history is mode 0600 or more restrictive. status: partial + notes: Missing a rule to check that .bash_history is mode 0600 or more restrictive. rules: - accounts_user_dot_group_ownership - accounts_user_dot_user_ownership - accounts_user_dot_no_world_writable_programs - file_permission_user_init_files - - var_user_initialization_files_regex=all_dotfiles - no_forward_files - no_netrc_files related_rules: From fc6d76d227f86a8e19f16fe52287a9f4b06a730f Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 8 Sep 2025 15:47:35 +0200 Subject: [PATCH 02/25] Add removed rules back to RHEL10 default profile and missing CCE. --- .../guide/services/base/service_cockpit_disabled/rule.yml | 3 +++ .../ssh/ssh_server/sshd_disable_forwarding/rule.yml | 3 +++ .../mounting/kernel_module_overlayfs_disabled/rule.yml | 1 + products/rhel10/profiles/default.profile | 7 +++++++ shared/references/cce-redhat-avail.txt | 3 --- 5 files changed, 14 insertions(+), 3 deletions(-) diff --git a/linux_os/guide/services/base/service_cockpit_disabled/rule.yml b/linux_os/guide/services/base/service_cockpit_disabled/rule.yml index 75c1154b8264..ae327a56e63b 100644 --- a/linux_os/guide/services/base/service_cockpit_disabled/rule.yml +++ b/linux_os/guide/services/base/service_cockpit_disabled/rule.yml @@ -13,6 +13,9 @@ rationale: |- severity: medium +identifiers: + cce@rhel10: CCE-87509-6 + platform: system_with_kernel ocil_clause: |- diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml index 2b38acabeb23..0464c8bff84d 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_forwarding/rule.yml @@ -11,6 +11,9 @@ rationale: |- severity: medium +identifiers: + cce@rhel10: CCE-87508-8 + ocil_clause: "The DisableForwarding option exists and is yes" ocil: |- diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml index 64c63b49d78a..b090a1a5a556 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_overlayfs_disabled/rule.yml @@ -17,6 +17,7 @@ rationale: |- severity: low identifiers: + cce@rhel10: CCE-87507-0 cce@sle15: CCE-92579-2 platform: system_with_kernel diff --git a/products/rhel10/profiles/default.profile b/products/rhel10/profiles/default.profile index 834f22559dba..46b9c336e29d 100644 --- a/products/rhel10/profiles/default.profile +++ b/products/rhel10/profiles/default.profile @@ -34,3 +34,10 @@ selections: - package_scap-security-guide_installed - set_password_hashing_yescrypt_cost_factor_logindefs - var_authselect_profile=local + - audit_rules_networkconfig_modification_network_scripts + - package_pam_pwquality_installed + - journald_compress + - socket_systemd-journal-remote_disabled + - package_systemd-journal-remote_installed + - journald_storage + - partition_for_dev_shm diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 2c6965a5ae7c..a9c6403a634e 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -487,9 +487,6 @@ CCE-87500-5 CCE-87501-3 CCE-87503-9 CCE-87505-4 -CCE-87507-0 -CCE-87508-8 -CCE-87509-6 CCE-87510-4 CCE-87511-2 CCE-87512-0 From e0b40153f6ff2de1a4f7fec312c35c625e44ac1f Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 15:18:42 +0200 Subject: [PATCH 03/25] Update RHEL 10 CIS profile stability data. --- .../data/profile_stability/rhel10/cis.profile | 74 +++---------------- .../rhel10/cis_server_l1.profile | 52 +++---------- .../rhel10/cis_workstation_l1.profile | 52 ++++--------- .../rhel10/cis_workstation_l2.profile | 74 +++---------------- 4 files changed, 49 insertions(+), 203 deletions(-) diff --git a/tests/data/profile_stability/rhel10/cis.profile b/tests/data/profile_stability/rhel10/cis.profile index 347c6fb734d2..6ffb384f05e0 100644 --- a/tests/data/profile_stability/rhel10/cis.profile +++ b/tests/data/profile_stability/rhel10/cis.profile @@ -54,11 +54,6 @@ audit_rules_dac_modification_setxattr audit_rules_execution_chacl audit_rules_execution_chcon audit_rules_execution_setfacl -audit_rules_file_deletion_events_rename -audit_rules_file_deletion_events_renameat -audit_rules_file_deletion_events_renameat2 -audit_rules_file_deletion_events_unlink -audit_rules_file_deletion_events_unlinkat audit_rules_immutable audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit @@ -69,8 +64,6 @@ audit_rules_login_events_lastlog audit_rules_mac_modification_etc_selinux audit_rules_mac_modification_usr_share audit_rules_media_export -audit_rules_networkconfig_modification -audit_rules_networkconfig_modification_network_scripts audit_rules_privileged_commands audit_rules_privileged_commands_kmod audit_rules_privileged_commands_usermod @@ -78,7 +71,6 @@ audit_rules_session_events_btmp audit_rules_session_events_utmp audit_rules_session_events_wtmp audit_rules_suid_auid_privilege_function -audit_rules_sysadmin_actions audit_rules_time_adjtimex audit_rules_time_clock_settime audit_rules_time_settimeofday @@ -88,15 +80,9 @@ audit_rules_unsuccessful_file_modification_ftruncate audit_rules_unsuccessful_file_modification_open audit_rules_unsuccessful_file_modification_openat audit_rules_unsuccessful_file_modification_truncate -audit_rules_usergroup_modification_group -audit_rules_usergroup_modification_gshadow -audit_rules_usergroup_modification_opasswd -audit_rules_usergroup_modification_passwd -audit_rules_usergroup_modification_shadow audit_sudo_log_events auditd_data_disk_error_action auditd_data_disk_full_action -auditd_data_retention_action_mail_acct auditd_data_retention_admin_space_left_action auditd_data_retention_max_log_file auditd_data_retention_max_log_file_action @@ -108,7 +94,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -120,11 +105,10 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay -dconf_gnome_screensaver_user_locks -dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits directory_permissions_var_log_audit disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -221,8 +205,6 @@ file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg file_permissions_var_log_audit -firewalld_loopback_traffic_restricted -firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -232,8 +214,14 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes -journald_compress -journald_storage +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_overlayfs_disabled +kernel_module_rds_disabled kernel_module_sctp_disabled kernel_module_squashfs_disabled kernel_module_tipc_disabled @@ -270,11 +258,9 @@ package_aide_installed package_audit-libs_installed package_audit_installed package_bind_removed -package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed -package_firewalld_installed package_ftp_removed package_gdm_removed package_httpd_removed @@ -282,24 +268,19 @@ package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed package_openldap-clients_removed -package_pam_pwquality_installed package_rsync_removed package_samba_removed package_setroubleshoot_removed package_squid_removed package_sudo_installed -package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed -partition_for_dev_shm partition_for_home -partition_for_tmp partition_for_var partition_for_var_log partition_for_var_log_audit @@ -316,19 +297,18 @@ service_auditd_enabled service_autofs_disabled service_avahi-daemon_disabled service_bluetooth_disabled +service_cockpit_disabled service_crond_enabled service_cups_disabled -service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth -socket_systemd-journal-remote_disabled sshd_disable_empty_passwords +sshd_disable_forwarding sshd_disable_gssapi_auth sshd_disable_rhosts sshd_disable_root_login @@ -353,12 +333,11 @@ sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication -sysctl_kernel_randomize_va_space -sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -390,8 +369,6 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled -sysctl_net_ipv6_conf_all_forwarding -sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects @@ -399,34 +376,8 @@ sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled use_pam_wheel_group_for_su -var_account_disable_post_pw_expiration=30 -var_accounts_maximum_age_login_defs=365 -var_accounts_minimum_age_login_defs=1 -var_accounts_password_warn_age_login_defs=7 -var_accounts_passwords_pam_faillock_deny=5 -var_accounts_passwords_pam_faillock_dir=run -var_accounts_passwords_pam_faillock_unlock_time=900 -var_accounts_tmout=15_min -var_accounts_user_umask=027 -var_auditd_action_mail_acct=root -var_auditd_admin_space_left_action=cis_rhel8 -var_auditd_disk_error_action=cis_rhel8 -var_auditd_disk_full_action=cis_rhel8 -var_auditd_max_log_file=6 -var_auditd_max_log_file_action=keep_logs -var_auditd_space_left_action=cis_rhel8 var_authselect_profile=local -var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis -var_password_hashing_algorithm=yescrypt -var_password_hashing_algorithm_pam=yescrypt -var_password_pam_dictcheck=1 -var_password_pam_difok=2 -var_password_pam_maxrepeat=3 -var_password_pam_minclass=4 -var_password_pam_minlen=14 -var_password_pam_remember=24 -var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -436,6 +387,5 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy -var_user_initialization_files_regex=all_dotfiles wireless_disable_interfaces xwindows_runlevel_target diff --git a/tests/data/profile_stability/rhel10/cis_server_l1.profile b/tests/data/profile_stability/rhel10/cis_server_l1.profile index 4a079ca18322..327df8529d9a 100644 --- a/tests/data/profile_stability/rhel10/cis_server_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_server_l1.profile @@ -41,7 +41,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -53,10 +52,9 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay -dconf_gnome_screensaver_user_locks -dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -144,8 +142,6 @@ file_permissions_sshd_pub_key file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg -firewalld_loopback_traffic_restricted -firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -153,8 +149,15 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes -journald_compress -journald_storage +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_rds_disabled +kernel_module_sctp_disabled +kernel_module_tipc_disabled kernel_module_usb-storage_disabled login_banner_text=cis_banners mount_option_dev_shm_nodev @@ -185,33 +188,26 @@ no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed package_bind_removed -package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed -package_firewalld_installed package_ftp_removed package_httpd_removed package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed -package_pam_pwquality_installed package_rsync_removed package_samba_removed package_setroubleshoot_removed package_squid_removed package_sudo_installed -package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed -partition_for_dev_shm -partition_for_tmp postfix_network_listening_disabled root_path_no_dot rsyslog_files_groupownership @@ -224,16 +220,13 @@ service_avahi-daemon_disabled service_bluetooth_disabled service_crond_enabled service_cups_disabled -service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth -socket_systemd-journal-remote_disabled sshd_disable_empty_passwords sshd_disable_rhosts sshd_disable_root_login @@ -256,13 +249,13 @@ sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile +sudo_require_authentication sudo_require_reauthentication -sysctl_kernel_randomize_va_space -sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -285,7 +278,6 @@ sysctl_net_ipv4_icmp_echo_ignore_broadcasts sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled sysctl_net_ipv4_icmp_ignore_bogus_error_responses sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled -sysctl_net_ipv4_ip_forward sysctl_net_ipv4_tcp_syncookies sysctl_net_ipv4_tcp_syncookies_value=enabled sysctl_net_ipv6_conf_all_accept_ra @@ -294,8 +286,6 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled -sysctl_net_ipv6_conf_all_forwarding -sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects @@ -303,25 +293,8 @@ sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled use_pam_wheel_group_for_su -var_account_disable_post_pw_expiration=30 -var_accounts_maximum_age_login_defs=365 -var_accounts_password_warn_age_login_defs=7 -var_accounts_passwords_pam_faillock_deny=5 -var_accounts_passwords_pam_faillock_unlock_time=900 -var_accounts_tmout=15_min -var_accounts_user_umask=027 var_authselect_profile=local -var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis -var_password_hashing_algorithm=yescrypt -var_password_hashing_algorithm_pam=yescrypt -var_password_pam_dictcheck=1 -var_password_pam_difok=2 -var_password_pam_maxrepeat=3 -var_password_pam_minclass=4 -var_password_pam_minlen=14 -var_password_pam_remember=24 -var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -330,5 +303,4 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy -var_user_initialization_files_regex=all_dotfiles wireless_disable_interfaces diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile index 4f4f9decda7d..fecdbf332b4f 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile @@ -41,7 +41,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -51,10 +50,9 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay -dconf_gnome_screensaver_user_locks -dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -142,8 +140,6 @@ file_permissions_sshd_pub_key file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg -firewalld_loopback_traffic_restricted -firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -151,8 +147,15 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes -journald_compress -journald_storage +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_rds_disabled +kernel_module_sctp_disabled +kernel_module_tipc_disabled login_banner_text=cis_banners mount_option_dev_shm_nodev mount_option_dev_shm_noexec @@ -182,32 +185,25 @@ no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed package_bind_removed -package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed -package_firewalld_installed package_ftp_removed package_httpd_removed package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed -package_pam_pwquality_installed package_rsync_removed package_samba_removed package_squid_removed package_sudo_installed -package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed -partition_for_dev_shm -partition_for_tmp postfix_network_listening_disabled root_path_no_dot rsyslog_files_groupownership @@ -216,17 +212,15 @@ rsyslog_files_permissions selinux_not_disabled selinux_policytype service_crond_enabled -service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth -socket_systemd-journal-remote_disabled sshd_disable_empty_passwords +sshd_disable_forwarding sshd_disable_gssapi_auth sshd_disable_rhosts sshd_disable_root_login @@ -249,13 +243,13 @@ sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile +sudo_require_authentication sudo_require_reauthentication -sysctl_kernel_randomize_va_space -sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -287,8 +281,6 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled -sysctl_net_ipv6_conf_all_forwarding -sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects @@ -296,25 +288,8 @@ sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled use_pam_wheel_group_for_su -var_account_disable_post_pw_expiration=30 -var_accounts_maximum_age_login_defs=365 -var_accounts_password_warn_age_login_defs=7 -var_accounts_passwords_pam_faillock_deny=5 -var_accounts_passwords_pam_faillock_unlock_time=900 -var_accounts_tmout=15_min -var_accounts_user_umask=027 var_authselect_profile=local -var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis -var_password_hashing_algorithm=yescrypt -var_password_hashing_algorithm_pam=yescrypt -var_password_pam_dictcheck=1 -var_password_pam_difok=2 -var_password_pam_maxrepeat=3 -var_password_pam_minclass=4 -var_password_pam_minlen=14 -var_password_pam_remember=24 -var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -323,4 +298,3 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy -var_user_initialization_files_regex=all_dotfiles diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile index 2b4d49fd2dd7..5bba79cef8fb 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile @@ -54,11 +54,6 @@ audit_rules_dac_modification_setxattr audit_rules_execution_chacl audit_rules_execution_chcon audit_rules_execution_setfacl -audit_rules_file_deletion_events_rename -audit_rules_file_deletion_events_renameat -audit_rules_file_deletion_events_renameat2 -audit_rules_file_deletion_events_unlink -audit_rules_file_deletion_events_unlinkat audit_rules_immutable audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit @@ -69,8 +64,6 @@ audit_rules_login_events_lastlog audit_rules_mac_modification_etc_selinux audit_rules_mac_modification_usr_share audit_rules_media_export -audit_rules_networkconfig_modification -audit_rules_networkconfig_modification_network_scripts audit_rules_privileged_commands audit_rules_privileged_commands_kmod audit_rules_privileged_commands_usermod @@ -78,7 +71,6 @@ audit_rules_session_events_btmp audit_rules_session_events_utmp audit_rules_session_events_wtmp audit_rules_suid_auid_privilege_function -audit_rules_sysadmin_actions audit_rules_time_adjtimex audit_rules_time_clock_settime audit_rules_time_settimeofday @@ -88,15 +80,9 @@ audit_rules_unsuccessful_file_modification_ftruncate audit_rules_unsuccessful_file_modification_open audit_rules_unsuccessful_file_modification_openat audit_rules_unsuccessful_file_modification_truncate -audit_rules_usergroup_modification_group -audit_rules_usergroup_modification_gshadow -audit_rules_usergroup_modification_opasswd -audit_rules_usergroup_modification_passwd -audit_rules_usergroup_modification_shadow audit_sudo_log_events auditd_data_disk_error_action auditd_data_disk_full_action -auditd_data_retention_action_mail_acct auditd_data_retention_admin_space_left_action auditd_data_retention_max_log_file auditd_data_retention_max_log_file_action @@ -108,7 +94,6 @@ chronyd_run_as_chrony_user chronyd_specify_remote_server cis_banner_text=cis configure_crypto_policy -configure_ssh_crypto_policy coredump_disable_backtraces coredump_disable_storage dconf_db_up_to_date @@ -120,11 +105,10 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay -dconf_gnome_screensaver_user_locks -dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits directory_permissions_var_log_audit disable_host_auth +disable_users_coredumps ensure_gpgcheck_globally_activated ensure_pam_wheel_group_empty ensure_root_password_configured @@ -221,8 +205,6 @@ file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg file_permissions_var_log_audit -firewalld_loopback_traffic_restricted -firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -232,8 +214,14 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes -journald_compress -journald_storage +kernel_module_cramfs_disabled +kernel_module_dccp_disabled +kernel_module_freevxfs_disabled +kernel_module_hfs_disabled +kernel_module_hfsplus_disabled +kernel_module_jffs2_disabled +kernel_module_overlayfs_disabled +kernel_module_rds_disabled kernel_module_sctp_disabled kernel_module_squashfs_disabled kernel_module_tipc_disabled @@ -270,34 +258,27 @@ package_aide_installed package_audit-libs_installed package_audit_installed package_bind_removed -package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed -package_firewalld_installed package_ftp_removed package_httpd_removed package_kea_removed package_libselinux_installed package_mcstrans_removed package_net-snmp_removed -package_nftables_installed package_nginx_removed package_openldap-clients_removed -package_pam_pwquality_installed package_rsync_removed package_samba_removed package_squid_removed package_sudo_installed -package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed -partition_for_dev_shm partition_for_home -partition_for_tmp partition_for_var partition_for_var_log partition_for_var_log_audit @@ -314,18 +295,17 @@ service_auditd_enabled service_autofs_disabled service_avahi-daemon_disabled service_bluetooth_disabled +service_cockpit_disabled service_crond_enabled -service_firewalld_enabled service_nfs_disabled -service_nftables_disabled service_rpcbind_disabled service_systemd-journald_enabled set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth -socket_systemd-journal-remote_disabled sshd_disable_empty_passwords +sshd_disable_forwarding sshd_disable_gssapi_auth sshd_disable_rhosts sshd_disable_root_login @@ -350,12 +330,11 @@ sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication -sysctl_kernel_randomize_va_space -sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route sysctl_net_ipv4_conf_all_accept_source_route_value=disabled +sysctl_net_ipv4_conf_all_forwarding sysctl_net_ipv4_conf_all_log_martians sysctl_net_ipv4_conf_all_log_martians_value=enabled sysctl_net_ipv4_conf_all_rp_filter @@ -387,8 +366,6 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled -sysctl_net_ipv6_conf_all_forwarding -sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects @@ -396,34 +373,8 @@ sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled use_pam_wheel_group_for_su -var_account_disable_post_pw_expiration=30 -var_accounts_maximum_age_login_defs=365 -var_accounts_minimum_age_login_defs=1 -var_accounts_password_warn_age_login_defs=7 -var_accounts_passwords_pam_faillock_deny=5 -var_accounts_passwords_pam_faillock_dir=run -var_accounts_passwords_pam_faillock_unlock_time=900 -var_accounts_tmout=15_min -var_accounts_user_umask=027 -var_auditd_action_mail_acct=root -var_auditd_admin_space_left_action=cis_rhel8 -var_auditd_disk_error_action=cis_rhel8 -var_auditd_disk_full_action=cis_rhel8 -var_auditd_max_log_file=6 -var_auditd_max_log_file_action=keep_logs -var_auditd_space_left_action=cis_rhel8 var_authselect_profile=local -var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis -var_password_hashing_algorithm=yescrypt -var_password_hashing_algorithm_pam=yescrypt -var_password_pam_dictcheck=1 -var_password_pam_difok=2 -var_password_pam_maxrepeat=3 -var_password_pam_minclass=4 -var_password_pam_minlen=14 -var_password_pam_remember=24 -var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -433,4 +384,3 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy -var_user_initialization_files_regex=all_dotfiles From c83d0858461cf10fc1c87511d7befe5294a74485 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 15:23:18 +0200 Subject: [PATCH 04/25] Update RHEL10 CIS profiles metadata. --- products/rhel10/profiles/cis.profile | 15 ++++++++++----- products/rhel10/profiles/cis_server_l1.profile | 15 ++++++++++----- .../rhel10/profiles/cis_workstation_l1.profile | 15 ++++++++++----- .../rhel10/profiles/cis_workstation_l2.profile | 15 ++++++++++----- 4 files changed, 40 insertions(+), 20 deletions(-) diff --git a/products/rhel10/profiles/cis.profile b/products/rhel10/profiles/cis.profile index 3d1b4a46b34b..8b38b00a53b3 100644 --- a/products/rhel10/profiles/cis.profile +++ b/products/rhel10/profiles/cis.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Server' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 2 - Server" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l2_server diff --git a/products/rhel10/profiles/cis_server_l1.profile b/products/rhel10/profiles/cis_server_l1.profile index dd3bfe6d1ea6..94bd1c5a5244 100644 --- a/products/rhel10/profiles/cis_server_l1.profile +++ b/products/rhel10/profiles/cis_server_l1.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Server' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 1 - Server" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l1_server diff --git a/products/rhel10/profiles/cis_workstation_l1.profile b/products/rhel10/profiles/cis_workstation_l1.profile index 40218aac378f..f0814c46a26c 100644 --- a/products/rhel10/profiles/cis_workstation_l1.profile +++ b/products/rhel10/profiles/cis_workstation_l1.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 1 - Workstation' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 1 - Workstation" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l1_workstation diff --git a/products/rhel10/profiles/cis_workstation_l2.profile b/products/rhel10/profiles/cis_workstation_l2.profile index 4e0a1723dcb8..3b0e00e529ed 100644 --- a/products/rhel10/profiles/cis_workstation_l2.profile +++ b/products/rhel10/profiles/cis_workstation_l2.profile @@ -2,17 +2,22 @@ documentation_complete: true metadata: + version: 1.0.0 SMEs: - - marcusburghardt + - mab879 + - ggbecker reference: https://www.cisecurity.org/benchmark/red_hat_linux/ -title: 'DRAFT - CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation' +title: 'CIS Red Hat Enterprise Linux 10 Benchmark for Level 2 - Workstation' description: |- - This is a draft profile for experimental purposes. - It is based on the CIS RHEL 9 profile, because an equivalent policy for RHEL 10 didn't yet - exist at time of the release. + This profile defines a baseline that aligns to the "Level 2 - Workstation" + configuration from the Center for Internet Security® Red Hat Enterprise + Linux 10 Benchmark™, v1.0.0, released 2025-08-27. + + This profile includes Center for Internet Security® + Red Hat Enterprise Linux 10 CIS Benchmarks™ content. selections: - cis_rhel10:all:l2_workstation From d220f7055809e3dddd74166e7ad364ba7b9081b9 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 17:16:24 +0200 Subject: [PATCH 05/25] Add missing rule. --- controls/cis_rhel10.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 769cce5ff919..e71f78dd0ba8 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -551,6 +551,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - sysctl_kernel_yama_ptrace_scope - id: 1.5.8 title: Ensure kernel.randomize_va_space is configured (Automated) From b4a2ba768f5d02d13932767a06bacd1429b6a095 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 17:16:59 +0200 Subject: [PATCH 06/25] Add missing rules to CIS RHEL10. These rules make sure the GDM configuration is locked. The requirement was merged. --- controls/cis_rhel10.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index e71f78dd0ba8..7941f7dbff7e 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -710,6 +710,8 @@ controls: rules: - dconf_gnome_screensaver_idle_delay - dconf_gnome_screensaver_lock_delay + - dconf_gnome_session_idle_user_locks + - dconf_gnome_screensaver_user_locks - inactivity_timeout_value=15_minutes - var_screensaver_lock_delay=5_seconds From 9970c76709a157848a7ab6bf5416d2854234dcad Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 17:19:02 +0200 Subject: [PATCH 07/25] Add variable back. --- controls/cis_rhel10.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 7941f7dbff7e..dfd4c75abd9c 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -3167,6 +3167,7 @@ controls: - accounts_user_dot_user_ownership - accounts_user_dot_no_world_writable_programs - file_permission_user_init_files + - var_user_initialization_files_regex=all_dotfiles - no_forward_files - no_netrc_files related_rules: From e2318d92536c0950367f30b43803057f4c826c85 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 17:26:33 +0200 Subject: [PATCH 08/25] Add variable back to CIS RHEL10. --- controls/cis_rhel10.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index dfd4c75abd9c..b8b05b4e8acb 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2251,6 +2251,7 @@ controls: - accounts_umask_etc_bashrc - accounts_umask_etc_login_defs - accounts_umask_etc_profile + - var_accounts_user_umask=027 - id: 6.1.1 title: Ensure AIDE is installed (Automated) From ad1cf6cdae64b6e0c3c6bae487ccfce4a814f0da Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 17:29:24 +0200 Subject: [PATCH 09/25] Enable package_pam_pwquality_installed back 5.3.1.3. The old requirement does not exist anymore 5.3.1.3 Ensure latest version of libpwquality is installed (Automated) --- controls/cis_rhel10.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index b8b05b4e8acb..6e0ecf2c1149 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -1853,7 +1853,7 @@ controls: - l1_server - l1_workstation status: automated - notes: This requirement is also indirectly satisfied by the requirement 5.3.3.1. + notes: This requirement is also indirectly satisfied by the requirement 5.3.2.1. rules: - account_password_pam_faillock_password_auth - account_password_pam_faillock_system_auth @@ -1864,8 +1864,8 @@ controls: - l1_server - l1_workstation status: automated - notes: This requirement is also indirectly satisfied by the requirement 5.3.3.2. - related_rules: + notes: This requirement is also indirectly satisfied by the requirement 5.3.2.2. + rules: - package_pam_pwquality_installed - id: 5.3.1.4 From a8893db65740c38894a3c4fd88d0149d65eee312 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 17:35:07 +0200 Subject: [PATCH 10/25] Add more rules and variable. --- controls/cis_rhel10.yml | 66 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 58 insertions(+), 8 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 6e0ecf2c1149..25fc90bb7b34 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -131,6 +131,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - partition_for_tmp - id: 1.1.2.1.2 title: Ensure nodev option set on /tmp partition (Automated) @@ -165,6 +167,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - partition_for_dev_shm - id: 1.1.2.2.2 title: Ensure nodev option set on /dev/shm partition (Automated) @@ -560,6 +564,10 @@ controls: - l1_server - l1_workstation status: automated + notes: |- + Address Space Layout Randomization (ASLR) + rules: + - sysctl_kernel_randomize_va_space - id: 1.5.9 title: Ensure systemd-coredump ProcessSizeMax is configured (Automated) @@ -605,6 +613,8 @@ controls: - l1_server - l1_workstation status: automated + related_rules: + - configure_crypto_policy - id: 1.6.4 title: Ensure system wide crypto policy disables cbc for ssh (Automated) @@ -1034,6 +1044,7 @@ controls: status: automated rules: - chronyd_specify_remote_server + - var_multiple_time_servers=rhel - id: 2.3.3 title: Ensure chrony is not run as the root user (Automated) @@ -1051,6 +1062,7 @@ controls: - l1_workstation status: automated rules: + - package_cron_installed - service_crond_enabled - id: 2.4.1.2 @@ -1407,6 +1419,9 @@ controls: - l1_server - l1_workstation status: automated + rules: + - sysctl_net_ipv6_conf_all_forwarding + - sysctl_net_ipv6_conf_all_forwarding_value=disabled - id: 3.3.2.2 title: Ensure net.ipv6.conf.default.forwarding is configured (Automated) @@ -1414,6 +1429,9 @@ controls: - l1_server - l1_workstation status: automated + rules: + - sysctl_net_ipv6_conf_default_forwarding + - sysctl_net_ipv6_conf_default_forwarding_value=disabled - id: 3.3.2.3 title: Ensure net.ipv6.conf.all.accept_redirects is configured (Automated) @@ -1481,13 +1499,15 @@ controls: - l1_server - l1_workstation status: automated + rules: + - package_firewalld_installed - id: 4.1.2 title: Ensure firewalld backend is configured (Automated) levels: - l1_server - l1_workstation - status: automated + status: pending - id: 4.1.3 title: Ensure firewalld.service is configured (Automated) @@ -1495,20 +1515,25 @@ controls: - l1_server - l1_workstation status: automated + rules: + - service_firewalld_enabled - id: 4.1.4 title: Ensure firewalld active zone target is configured (Automated) levels: - l1_server - l1_workstation - status: automated + status: pending - id: 4.1.5 - title: Ensure firewalld loopback traffic is configured (Manual) + title: Ensure firewalld loopback traffic is configured (Automated) levels: - l1_server - l1_workstation - status: manual + status: supported + rules: + - firewalld_loopback_traffic_trusted + - firewalld_loopback_traffic_restricted - id: 4.1.6 title: Ensure firewalld loopback source address traffic is configured (Manual) @@ -1523,6 +1548,8 @@ controls: - l1_server - l1_workstation status: manual + related_rules: + - configure_firewalld_ports - id: 5.1.1 title: Ensure access to /etc/ssh/sshd_config is configured (Automated) @@ -1902,6 +1929,7 @@ controls: status: automated rules: - accounts_passwords_pam_faillock_deny + - var_accounts_passwords_pam_faillock_deny=5 - id: 5.3.2.1.2 title: Ensure password unlock time is configured (Automated) @@ -1915,6 +1943,7 @@ controls: attack to legitimate users. rules: - accounts_passwords_pam_faillock_unlock_time + - var_accounts_passwords_pam_faillock_unlock_time=900 - id: 5.3.2.1.3 title: Ensure password failed attempts lockout includes root account (Automated) @@ -1933,6 +1962,7 @@ controls: status: automated rules: - accounts_password_pam_difok + - var_password_pam_difok=2 - id: 5.3.2.2.2 title: Ensure password length is configured (Automated) @@ -1942,6 +1972,7 @@ controls: status: automated rules: - accounts_password_pam_minlen + - var_password_pam_minlen=14 - id: 5.3.2.2.3 title: Ensure password complexity is configured (Manual) @@ -1955,13 +1986,14 @@ controls: RHEL 10 in this new version. Rules related to other options are informed in related_rules. In short, minclass=4 alone can achieve the same result achieved by the combination of the other 4 options mentioned in the policy. + rules: + - accounts_password_pam_minclass + - var_password_pam_minclass=4 related_rules: - accounts_password_pam_dcredit - accounts_password_pam_lcredit - accounts_password_pam_ocredit - accounts_password_pam_ucredit - rules: - - accounts_password_pam_minclass - id: 5.3.2.2.4 title: Ensure password same consecutive characters is configured (Automated) @@ -1971,6 +2003,7 @@ controls: status: automated rules: - accounts_password_pam_maxrepeat + - var_password_pam_maxrepeat=3 - id: 5.3.2.2.5 title: Ensure password maximum sequential characters is configured (Automated) @@ -1988,6 +2021,7 @@ controls: status: automated rules: - accounts_password_pam_dictcheck + - var_password_pam_dictcheck=1 - id: 5.3.2.2.7 title: Ensure password quality is enforced for the root user (Automated) @@ -2011,6 +2045,8 @@ controls: rules: - accounts_password_pam_pwhistory_remember_password_auth - accounts_password_pam_pwhistory_remember_system_auth + - var_password_pam_remember_control_flag=requisite_or_required + - var_password_pam_remember=24 related_rules: - accounts_password_pam_retry @@ -2071,6 +2107,7 @@ controls: rules: - set_password_hashing_algorithm_systemauth - set_password_hashing_algorithm_passwordauth + - var_password_hashing_algorithm_pam=yescrypt - id: 5.3.2.4.4 title: Ensure pam_unix includes use_authtok (Automated) @@ -2091,6 +2128,7 @@ controls: status: automated rules: - accounts_maximum_age_login_defs + - var_accounts_maximum_age_login_defs=365 - accounts_password_set_max_life_existing - id: 5.4.1.2 @@ -2111,6 +2149,7 @@ controls: status: automated rules: - accounts_password_warn_age_login_defs + - var_accounts_password_warn_age_login_defs=7 - accounts_password_set_warn_age_existing - id: 5.4.1.4 @@ -2125,6 +2164,7 @@ controls: rules: - set_password_hashing_algorithm_libuserconf - set_password_hashing_algorithm_logindefs + - var_password_hashing_algorithm=yescrypt - id: 5.4.1.5 title: Ensure inactive password lock is configured (Automated) @@ -2135,6 +2175,7 @@ controls: rules: - account_disable_post_pw_expiration - accounts_set_post_pw_existing + - var_account_disable_post_pw_expiration=30 - id: 5.4.1.6 title: Ensure all users last password change date is in the past (Automated) @@ -2240,6 +2281,7 @@ controls: status: automated rules: - accounts_tmout + - var_accounts_tmout=15_min - id: 5.4.3.3 title: Ensure default user umask is configured (Automated) @@ -2321,7 +2363,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending notes: This rule conflicts with 6.2.3.3. More investigation is needed to properly solve this. related_rules: - journald_forward_to_syslog @@ -2332,6 +2374,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - journald_compress - id: 6.2.2.4 title: Ensure journald Storage is configured (Automated) @@ -2339,6 +2383,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - journald_storage - id: 6.2.2.1.1 title: Ensure systemd-journal-remote is installed (Automated) @@ -2346,6 +2392,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - package_systemd-journal-remote_installed - id: 6.2.2.1.2 title: Ensure systemd-journal-upload authentication is configured (Manual) @@ -2359,7 +2407,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending notes: New templated rule is necessary. - id: 6.2.2.1.4 @@ -2368,6 +2416,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - socket_systemd-journal-remote_disabled - id: 6.2.3.1 title: Ensure rsyslog is installed (Automated) From 26883bd5303f689cbdb3fcd475d28356f7fec60c Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:14:19 +0200 Subject: [PATCH 11/25] Process audit items. --- controls/cis_rhel10.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 25fc90bb7b34..8c716a6a18fd 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2680,6 +2680,8 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_usergroup_modification_group - id: 6.3.3.13 title: Ensure events that modify /etc/passwd information are collected (Automated) @@ -2687,6 +2689,8 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_usergroup_modification_passwd - id: 6.3.3.14 title: Ensure events that modify /etc/shadow and /etc/gshadow are collected (Automated) @@ -2694,6 +2698,9 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_usergroup_modification_gshadow + - audit_rules_usergroup_modification_shadow - id: 6.3.3.15 title: Ensure events that modify /etc/security/opasswd are collected (Automated) @@ -2701,20 +2708,22 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_usergroup_modification_opasswd - id: 6.3.3.16 title: Ensure events that modify /etc/nsswitch.conf file are collected (Automated) levels: - l2_server - l2_workstation - status: automated + status: pending - id: 6.3.3.17 title: Ensure events that modify /etc/pam.conf and /etc/pam.d/ information are collected (Automated) levels: - l2_server - l2_workstation - status: automated + status: pending - id: 6.3.3.18 title: Ensure discretionary access control permission modification events chmod,fchmod,fchmodat,fchmodat2 are collected (Automated) From 5f5cc935777cb9dda7b68680379502d4a7205e17 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:17:55 +0200 Subject: [PATCH 12/25] Revert more rules and variables. --- controls/cis_rhel10.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 8c716a6a18fd..a9182e4e01e8 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2548,6 +2548,7 @@ controls: status: automated rules: - auditd_data_retention_max_log_file + - var_auditd_max_log_file=6 - id: 6.3.2.2 title: Ensure audit logs are not automatically deleted (Automated) @@ -2557,6 +2558,7 @@ controls: status: automated rules: - auditd_data_retention_max_log_file_action + - var_auditd_max_log_file_action=keep_logs - id: 6.3.2.3 title: Ensure system is disabled when audit logs are full (Automated) @@ -2799,6 +2801,9 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_file_deletion_events_unlink + - audit_rules_file_deletion_events_unlinkat - id: 6.3.3.25 title: Ensure rename file deletion events by users are collected (Automated) @@ -2806,6 +2811,10 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_file_deletion_events_rename + - audit_rules_file_deletion_events_renameat + - audit_rules_file_deletion_events_renameat2 - id: 6.3.3.26 title: Ensure events that modify the system's Mandatory Access Controls are collected (Automated) From a38bb79e699eb86f13fc282da66b85b3c7c6c57b Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:22:33 +0200 Subject: [PATCH 13/25] Add new CIS RHEL10 variable. --- controls/cis_rhel10.yml | 2 ++ .../var_auditd_disk_error_action.var | 1 + .../var_auditd_disk_full_action.var | 1 + 3 files changed, 4 insertions(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index a9182e4e01e8..33fe4a59c05c 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2569,6 +2569,8 @@ controls: rules: - auditd_data_disk_error_action - auditd_data_disk_full_action + - var_auditd_disk_error_action=cis_rhel10 + - var_auditd_disk_full_action=cis_rhel10 - id: 6.3.2.4 title: Ensure system warns when audit logs are low on space (Automated) diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var index 7ea8d50de562..12ed949df037 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_error_action.var @@ -23,6 +23,7 @@ options: rhel8: syslog|single|halt cis_rhel8: syslog|single|halt cis_rhel9: syslog|single|halt + cis_rhel10: syslog|single|halt cis_ubuntu2404: syslog|single|halt cis_debian12: syslog|single|halt diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var index 7bbb940a02fb..efa7096e0f00 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_disk_full_action.var @@ -24,5 +24,6 @@ options: rhel8: syslog|single|halt cis_rhel8: syslog|single|halt cis_rhel9: halt|single + cis_rhel10: halt|single cis_ubuntu2404: halt|single cis_debian12: halt|single From ba1375b67b93574c104583c6c01a2122fcae19f1 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:35:25 +0200 Subject: [PATCH 14/25] Add more rules to CIS RHEL10. --- controls/cis_rhel10.yml | 21 +++++++++++++++++++ .../var_auditd_admin_space_left_action.var | 1 + .../var_auditd_space_left_action.var | 1 + 3 files changed, 23 insertions(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 33fe4a59c05c..ea0edba530ac 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2579,8 +2579,12 @@ controls: - l2_workstation status: automated rules: + - auditd_data_retention_action_mail_acct - auditd_data_retention_admin_space_left_action - auditd_data_retention_space_left_action + - var_auditd_action_mail_acct=root + - var_auditd_admin_space_left_action=cis_rhel10 + - var_auditd_space_left_action=cis_rhel10 - id: 6.3.3.1 title: Ensure modification of the /etc/sudoers file is collected (Automated) @@ -2627,6 +2631,9 @@ controls: - l2_server - l2_workstation status: automated + notes: This requirement is covered by 6.3.3.6. + related_rules: + - audit_rules_networkconfig_modification - id: 6.3.3.6 title: Ensure events that modify /etc/issue and /etc/issue.net are collected (Automated) @@ -2634,6 +2641,9 @@ controls: - l2_server - l2_workstation status: automated + # TODO: The rule covering this requirement needs to be split into multiple rules. + rules: + - audit_rules_networkconfig_modification - id: 6.3.3.7 title: Ensure events that modify /etc/hosts and /etc/hostname are collected (Automated) @@ -2641,6 +2651,9 @@ controls: - l2_server - l2_workstation status: automated + notes: This requirement is partially covered by 6.3.3.6. + related_rules: + - audit_rules_networkconfig_modification - id: 6.3.3.8 title: Ensure events that modify /etc/sysconfig/network and /etc/sysconfig/network-scripts/ are collected (Automated) @@ -2648,6 +2661,11 @@ controls: - l2_server - l2_workstation status: automated + notes: This requirement is partially covered by 6.3.3.6. + rules: + - audit_rules_networkconfig_modification_network_scripts + related_rules: + - audit_rules_networkconfig_modification - id: 6.3.3.9 title: Ensure events that modify /etc/NetworkManager directory are collected (Automated) @@ -2655,6 +2673,9 @@ controls: - l2_server - l2_workstation status: automated + notes: This requirement is covered by 6.3.3.6. + related_rules: + - audit_rules_networkconfig_modification - id: 6.3.3.10 title: Ensure use of privileged commands are collected (Automated) diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var index 2131e03638c3..c8c59c4a4891 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_admin_space_left_action.var @@ -20,3 +20,4 @@ options: ignore: ignore cis_rhel8: single|halt cis_rhel9: single|halt + cis_rhel10: single|halt diff --git a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var index f5d81f5ccf9e..53eb3f939a7e 100644 --- a/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var +++ b/linux_os/guide/auditing/configure_auditd_data_retention/var_auditd_space_left_action.var @@ -20,3 +20,4 @@ options: ignore: ignore cis_rhel8: email|exec|single|halt cis_rhel9: email|exec|single|halt + cis_rhel10: email|exec|single|halt From 85ad5e902155e03b4818f9e1d8382f7a1b2ce116 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:38:31 +0200 Subject: [PATCH 15/25] Add more rules and variables. --- controls/cis_rhel10.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index ea0edba530ac..7b4f3c33b554 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2132,13 +2132,14 @@ controls: - accounts_password_set_max_life_existing - id: 5.4.1.2 - title: Ensure minimum password days is configured (Manual) + title: Ensure minimum password days is configured (Automated) levels: - l2_server - l2_workstation - status: manual + status: automated rules: - accounts_minimum_age_login_defs + - var_accounts_minimum_age_login_defs=1 - accounts_password_set_min_life_existing - id: 5.4.1.3 From a7453bc913b267850727974907deffa85aa98b19 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:43:07 +0200 Subject: [PATCH 16/25] Add more rules and variables to CIS RHEL10. --- controls/cis_rhel10.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 7b4f3c33b554..c56e430f38ca 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2593,6 +2593,8 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_sysadmin_actions - id: 6.3.3.2 title: Ensure actions as another user are always logged (Automated) @@ -2818,6 +2820,7 @@ controls: rules: - audit_rules_login_events_faillock - audit_rules_login_events_lastlog + - var_accounts_passwords_pam_faillock_dir=run - id: 6.3.3.24 title: Ensure unlink file deletion events by users are collected (Automated) From fc3aab92833cbab5af6b08b9e07683ddd2578775 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:44:29 +0200 Subject: [PATCH 17/25] Adjust more variables. --- controls/cis_rhel10.yml | 6 +++--- linux_os/guide/services/ssh/sshd_strong_kex.var | 1 + linux_os/guide/services/ssh/sshd_strong_macs.var | 1 + 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index c56e430f38ca..c8f53ed56a31 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -1615,7 +1615,7 @@ controls: Therefore I moved it to pending until deeper investigation. related_rules: - sshd_use_approved_ciphers - - sshd_approved_ciphers=cis_rhel8 + - sshd_approved_ciphers=cis_rhel10 - id: 5.1.7 title: Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured (Automated) @@ -1683,7 +1683,7 @@ controls: Therefore I moved it to pending until deeper investigation. rules: - sshd_use_strong_kex - - sshd_strong_kex=cis_rhel8 + - sshd_strong_kex=cis_rhel10 - id: 5.1.13 title: Ensure sshd LoginGraceTime is configured (Automated) @@ -1721,7 +1721,7 @@ controls: Therefore I moved it to pending until deeper investigation. rules: - sshd_use_strong_macs - - sshd_strong_macs=cis_rhel8 + - sshd_strong_macs=cis_rhel10 - id: 5.1.16 title: Ensure sshd MaxAuthTries is configured (Automated) diff --git a/linux_os/guide/services/ssh/sshd_strong_kex.var b/linux_os/guide/services/ssh/sshd_strong_kex.var index 059b2674fe3a..d4a78a3fe45e 100644 --- a/linux_os/guide/services/ssh/sshd_strong_kex.var +++ b/linux_os/guide/services/ssh/sshd_strong_kex.var @@ -15,6 +15,7 @@ options: pcidss: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 cis_rhel8: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 cis_rhel9: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 + cis_rhel10: -diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1 cis_sle12: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 cis_sle15: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256 cis_ubuntu2204: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 diff --git a/linux_os/guide/services/ssh/sshd_strong_macs.var b/linux_os/guide/services/ssh/sshd_strong_macs.var index d7c2a416c849..03f8dee10d54 100644 --- a/linux_os/guide/services/ssh/sshd_strong_macs.var +++ b/linux_os/guide/services/ssh/sshd_strong_macs.var @@ -14,6 +14,7 @@ options: default: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 cis_rhel8: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com cis_rhel9: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com + cis_rhel10: -hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-sha1-96,umac-64@openssh.com,hmac-md5-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,umac-64-etm@openssh.com cis_sle12: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160 cis_sle15: hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256 cis_tencentos4: hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-256-etm@openssh.com From 2d85677dfc440e6722154069d9ab984155941955 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:46:12 +0200 Subject: [PATCH 18/25] Update stability test data. --- .../data/profile_stability/rhel10/cis.profile | 65 ++++++++++++++++++- .../rhel10/cis_server_l1.profile | 42 +++++++++++- .../rhel10/cis_workstation_l1.profile | 42 +++++++++++- .../rhel10/cis_workstation_l2.profile | 65 ++++++++++++++++++- 4 files changed, 206 insertions(+), 8 deletions(-) diff --git a/tests/data/profile_stability/rhel10/cis.profile b/tests/data/profile_stability/rhel10/cis.profile index 6ffb384f05e0..e1374084da14 100644 --- a/tests/data/profile_stability/rhel10/cis.profile +++ b/tests/data/profile_stability/rhel10/cis.profile @@ -54,6 +54,11 @@ audit_rules_dac_modification_setxattr audit_rules_execution_chacl audit_rules_execution_chcon audit_rules_execution_setfacl +audit_rules_file_deletion_events_rename +audit_rules_file_deletion_events_renameat +audit_rules_file_deletion_events_renameat2 +audit_rules_file_deletion_events_unlink +audit_rules_file_deletion_events_unlinkat audit_rules_immutable audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit @@ -64,6 +69,8 @@ audit_rules_login_events_lastlog audit_rules_mac_modification_etc_selinux audit_rules_mac_modification_usr_share audit_rules_media_export +audit_rules_networkconfig_modification +audit_rules_networkconfig_modification_network_scripts audit_rules_privileged_commands audit_rules_privileged_commands_kmod audit_rules_privileged_commands_usermod @@ -71,6 +78,7 @@ audit_rules_session_events_btmp audit_rules_session_events_utmp audit_rules_session_events_wtmp audit_rules_suid_auid_privilege_function +audit_rules_sysadmin_actions audit_rules_time_adjtimex audit_rules_time_clock_settime audit_rules_time_settimeofday @@ -80,9 +88,15 @@ audit_rules_unsuccessful_file_modification_ftruncate audit_rules_unsuccessful_file_modification_open audit_rules_unsuccessful_file_modification_openat audit_rules_unsuccessful_file_modification_truncate +audit_rules_usergroup_modification_group +audit_rules_usergroup_modification_gshadow +audit_rules_usergroup_modification_opasswd +audit_rules_usergroup_modification_passwd +audit_rules_usergroup_modification_shadow audit_sudo_log_events auditd_data_disk_error_action auditd_data_disk_full_action +auditd_data_retention_action_mail_acct auditd_data_retention_admin_space_left_action auditd_data_retention_max_log_file auditd_data_retention_max_log_file_action @@ -105,6 +119,8 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay +dconf_gnome_screensaver_user_locks +dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits directory_permissions_var_log_audit disable_host_auth @@ -205,6 +221,8 @@ file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg file_permissions_var_log_audit +firewalld_loopback_traffic_restricted +firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -214,6 +232,8 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes +journald_compress +journald_storage kernel_module_cramfs_disabled kernel_module_dccp_disabled kernel_module_freevxfs_disabled @@ -258,9 +278,11 @@ package_aide_installed package_audit-libs_installed package_audit_installed package_bind_removed +package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed +package_firewalld_installed package_ftp_removed package_gdm_removed package_httpd_removed @@ -270,17 +292,21 @@ package_mcstrans_removed package_net-snmp_removed package_nginx_removed package_openldap-clients_removed +package_pam_pwquality_installed package_rsync_removed package_samba_removed package_setroubleshoot_removed package_squid_removed package_sudo_installed +package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed +partition_for_dev_shm partition_for_home +partition_for_tmp partition_for_var partition_for_var_log partition_for_var_log_audit @@ -300,6 +326,7 @@ service_bluetooth_disabled service_cockpit_disabled service_crond_enabled service_cups_disabled +service_firewalld_enabled service_nfs_disabled service_rpcbind_disabled service_systemd-journald_enabled @@ -307,6 +334,7 @@ set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth +socket_systemd-journal-remote_disabled sshd_disable_empty_passwords sshd_disable_forwarding sshd_disable_gssapi_auth @@ -325,14 +353,16 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_kernel_randomize_va_space +sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route @@ -369,15 +399,45 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled +sysctl_net_ipv6_conf_all_forwarding +sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su +var_account_disable_post_pw_expiration=30 +var_accounts_maximum_age_login_defs=365 +var_accounts_minimum_age_login_defs=1 +var_accounts_password_warn_age_login_defs=7 +var_accounts_passwords_pam_faillock_deny=5 +var_accounts_passwords_pam_faillock_dir=run +var_accounts_passwords_pam_faillock_unlock_time=900 +var_accounts_tmout=15_min +var_accounts_user_umask=027 +var_auditd_action_mail_acct=root +var_auditd_admin_space_left_action=cis_rhel10 +var_auditd_disk_error_action=cis_rhel10 +var_auditd_disk_full_action=cis_rhel10 +var_auditd_max_log_file=6 +var_auditd_max_log_file_action=keep_logs +var_auditd_space_left_action=cis_rhel10 var_authselect_profile=local +var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis +var_password_hashing_algorithm=yescrypt +var_password_hashing_algorithm_pam=yescrypt +var_password_pam_dictcheck=1 +var_password_pam_difok=2 +var_password_pam_maxrepeat=3 +var_password_pam_minclass=4 +var_password_pam_minlen=14 +var_password_pam_remember=24 +var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -387,5 +447,6 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy +var_user_initialization_files_regex=all_dotfiles wireless_disable_interfaces xwindows_runlevel_target diff --git a/tests/data/profile_stability/rhel10/cis_server_l1.profile b/tests/data/profile_stability/rhel10/cis_server_l1.profile index 327df8529d9a..7bdcb1bef233 100644 --- a/tests/data/profile_stability/rhel10/cis_server_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_server_l1.profile @@ -52,6 +52,8 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay +dconf_gnome_screensaver_user_locks +dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits disable_host_auth disable_users_coredumps @@ -142,6 +144,8 @@ file_permissions_sshd_pub_key file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg +firewalld_loopback_traffic_restricted +firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -149,6 +153,8 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes +journald_compress +journald_storage kernel_module_cramfs_disabled kernel_module_dccp_disabled kernel_module_freevxfs_disabled @@ -188,9 +194,11 @@ no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed package_bind_removed +package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed +package_firewalld_installed package_ftp_removed package_httpd_removed package_kea_removed @@ -198,16 +206,20 @@ package_libselinux_installed package_mcstrans_removed package_net-snmp_removed package_nginx_removed +package_pam_pwquality_installed package_rsync_removed package_samba_removed package_setroubleshoot_removed package_squid_removed package_sudo_installed +package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed +partition_for_dev_shm +partition_for_tmp postfix_network_listening_disabled root_path_no_dot rsyslog_files_groupownership @@ -220,6 +232,7 @@ service_avahi-daemon_disabled service_bluetooth_disabled service_crond_enabled service_cups_disabled +service_firewalld_enabled service_nfs_disabled service_rpcbind_disabled service_systemd-journald_enabled @@ -227,6 +240,7 @@ set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth +socket_systemd-journal-remote_disabled sshd_disable_empty_passwords sshd_disable_rhosts sshd_disable_root_login @@ -243,14 +257,16 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_kernel_randomize_va_space +sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route @@ -286,15 +302,36 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled +sysctl_net_ipv6_conf_all_forwarding +sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su +var_account_disable_post_pw_expiration=30 +var_accounts_maximum_age_login_defs=365 +var_accounts_password_warn_age_login_defs=7 +var_accounts_passwords_pam_faillock_deny=5 +var_accounts_passwords_pam_faillock_unlock_time=900 +var_accounts_tmout=15_min +var_accounts_user_umask=027 var_authselect_profile=local +var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis +var_password_hashing_algorithm=yescrypt +var_password_hashing_algorithm_pam=yescrypt +var_password_pam_dictcheck=1 +var_password_pam_difok=2 +var_password_pam_maxrepeat=3 +var_password_pam_minclass=4 +var_password_pam_minlen=14 +var_password_pam_remember=24 +var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -303,4 +340,5 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy +var_user_initialization_files_regex=all_dotfiles wireless_disable_interfaces diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile index fecdbf332b4f..370ca60f92ed 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile @@ -50,6 +50,8 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay +dconf_gnome_screensaver_user_locks +dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits disable_host_auth disable_users_coredumps @@ -140,6 +142,8 @@ file_permissions_sshd_pub_key file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg +firewalld_loopback_traffic_restricted +firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -147,6 +151,8 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes +journald_compress +journald_storage kernel_module_cramfs_disabled kernel_module_dccp_disabled kernel_module_freevxfs_disabled @@ -185,9 +191,11 @@ no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed package_bind_removed +package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed +package_firewalld_installed package_ftp_removed package_httpd_removed package_kea_removed @@ -195,15 +203,19 @@ package_libselinux_installed package_mcstrans_removed package_net-snmp_removed package_nginx_removed +package_pam_pwquality_installed package_rsync_removed package_samba_removed package_squid_removed package_sudo_installed +package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed +partition_for_dev_shm +partition_for_tmp postfix_network_listening_disabled root_path_no_dot rsyslog_files_groupownership @@ -212,6 +224,7 @@ rsyslog_files_permissions selinux_not_disabled selinux_policytype service_crond_enabled +service_firewalld_enabled service_nfs_disabled service_rpcbind_disabled service_systemd-journald_enabled @@ -219,6 +232,7 @@ set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth +socket_systemd-journal-remote_disabled sshd_disable_empty_passwords sshd_disable_forwarding sshd_disable_gssapi_auth @@ -237,14 +251,16 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_kernel_randomize_va_space +sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route @@ -281,15 +297,36 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled +sysctl_net_ipv6_conf_all_forwarding +sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su +var_account_disable_post_pw_expiration=30 +var_accounts_maximum_age_login_defs=365 +var_accounts_password_warn_age_login_defs=7 +var_accounts_passwords_pam_faillock_deny=5 +var_accounts_passwords_pam_faillock_unlock_time=900 +var_accounts_tmout=15_min +var_accounts_user_umask=027 var_authselect_profile=local +var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis +var_password_hashing_algorithm=yescrypt +var_password_hashing_algorithm_pam=yescrypt +var_password_pam_dictcheck=1 +var_password_pam_difok=2 +var_password_pam_maxrepeat=3 +var_password_pam_minclass=4 +var_password_pam_minlen=14 +var_password_pam_remember=24 +var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -298,3 +335,4 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy +var_user_initialization_files_regex=all_dotfiles diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile index 5bba79cef8fb..c7e233bab75c 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile @@ -54,6 +54,11 @@ audit_rules_dac_modification_setxattr audit_rules_execution_chacl audit_rules_execution_chcon audit_rules_execution_setfacl +audit_rules_file_deletion_events_rename +audit_rules_file_deletion_events_renameat +audit_rules_file_deletion_events_renameat2 +audit_rules_file_deletion_events_unlink +audit_rules_file_deletion_events_unlinkat audit_rules_immutable audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit @@ -64,6 +69,8 @@ audit_rules_login_events_lastlog audit_rules_mac_modification_etc_selinux audit_rules_mac_modification_usr_share audit_rules_media_export +audit_rules_networkconfig_modification +audit_rules_networkconfig_modification_network_scripts audit_rules_privileged_commands audit_rules_privileged_commands_kmod audit_rules_privileged_commands_usermod @@ -71,6 +78,7 @@ audit_rules_session_events_btmp audit_rules_session_events_utmp audit_rules_session_events_wtmp audit_rules_suid_auid_privilege_function +audit_rules_sysadmin_actions audit_rules_time_adjtimex audit_rules_time_clock_settime audit_rules_time_settimeofday @@ -80,9 +88,15 @@ audit_rules_unsuccessful_file_modification_ftruncate audit_rules_unsuccessful_file_modification_open audit_rules_unsuccessful_file_modification_openat audit_rules_unsuccessful_file_modification_truncate +audit_rules_usergroup_modification_group +audit_rules_usergroup_modification_gshadow +audit_rules_usergroup_modification_opasswd +audit_rules_usergroup_modification_passwd +audit_rules_usergroup_modification_shadow audit_sudo_log_events auditd_data_disk_error_action auditd_data_disk_full_action +auditd_data_retention_action_mail_acct auditd_data_retention_admin_space_left_action auditd_data_retention_max_log_file auditd_data_retention_max_log_file_action @@ -105,6 +119,8 @@ dconf_gnome_disable_user_list dconf_gnome_login_banner_text dconf_gnome_screensaver_idle_delay dconf_gnome_screensaver_lock_delay +dconf_gnome_screensaver_user_locks +dconf_gnome_session_idle_user_locks dir_perms_world_writable_sticky_bits directory_permissions_var_log_audit disable_host_auth @@ -205,6 +221,8 @@ file_permissions_unauthorized_world_writable file_permissions_ungroupowned file_permissions_user_cfg file_permissions_var_log_audit +firewalld_loopback_traffic_restricted +firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name @@ -214,6 +232,8 @@ grub2_enable_selinux grub2_password has_nonlocal_mta inactivity_timeout_value=15_minutes +journald_compress +journald_storage kernel_module_cramfs_disabled kernel_module_dccp_disabled kernel_module_freevxfs_disabled @@ -258,9 +278,11 @@ package_aide_installed package_audit-libs_installed package_audit_installed package_bind_removed +package_cron_installed package_cyrus-imapd_removed package_dnsmasq_removed package_dovecot_removed +package_firewalld_installed package_ftp_removed package_httpd_removed package_kea_removed @@ -269,16 +291,20 @@ package_mcstrans_removed package_net-snmp_removed package_nginx_removed package_openldap-clients_removed +package_pam_pwquality_installed package_rsync_removed package_samba_removed package_squid_removed package_sudo_installed +package_systemd-journal-remote_installed package_telnet-server_removed package_telnet_removed package_tftp-server_removed package_tftp_removed package_vsftpd_removed +partition_for_dev_shm partition_for_home +partition_for_tmp partition_for_var partition_for_var_log partition_for_var_log_audit @@ -297,6 +323,7 @@ service_avahi-daemon_disabled service_bluetooth_disabled service_cockpit_disabled service_crond_enabled +service_firewalld_enabled service_nfs_disabled service_rpcbind_disabled service_systemd-journald_enabled @@ -304,6 +331,7 @@ set_password_hashing_algorithm_libuserconf set_password_hashing_algorithm_logindefs set_password_hashing_algorithm_passwordauth set_password_hashing_algorithm_systemauth +socket_systemd-journal-remote_disabled sshd_disable_empty_passwords sshd_disable_forwarding sshd_disable_gssapi_auth @@ -322,14 +350,16 @@ sshd_set_loglevel_verbose sshd_set_max_auth_tries sshd_set_max_sessions sshd_set_maxstartups -sshd_strong_kex=cis_rhel8 -sshd_strong_macs=cis_rhel8 +sshd_strong_kex=cis_rhel10 +sshd_strong_macs=cis_rhel10 sshd_use_strong_kex sshd_use_strong_macs sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_kernel_randomize_va_space +sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects sysctl_net_ipv4_conf_all_accept_redirects_value=disabled sysctl_net_ipv4_conf_all_accept_source_route @@ -366,15 +396,45 @@ sysctl_net_ipv6_conf_all_accept_redirects sysctl_net_ipv6_conf_all_accept_redirects_value=disabled sysctl_net_ipv6_conf_all_accept_source_route sysctl_net_ipv6_conf_all_accept_source_route_value=disabled +sysctl_net_ipv6_conf_all_forwarding +sysctl_net_ipv6_conf_all_forwarding_value=disabled sysctl_net_ipv6_conf_default_accept_ra sysctl_net_ipv6_conf_default_accept_ra_value=disabled sysctl_net_ipv6_conf_default_accept_redirects sysctl_net_ipv6_conf_default_accept_redirects_value=disabled sysctl_net_ipv6_conf_default_accept_source_route sysctl_net_ipv6_conf_default_accept_source_route_value=disabled +sysctl_net_ipv6_conf_default_forwarding +sysctl_net_ipv6_conf_default_forwarding_value=disabled use_pam_wheel_group_for_su +var_account_disable_post_pw_expiration=30 +var_accounts_maximum_age_login_defs=365 +var_accounts_minimum_age_login_defs=1 +var_accounts_password_warn_age_login_defs=7 +var_accounts_passwords_pam_faillock_deny=5 +var_accounts_passwords_pam_faillock_dir=run +var_accounts_passwords_pam_faillock_unlock_time=900 +var_accounts_tmout=15_min +var_accounts_user_umask=027 +var_auditd_action_mail_acct=root +var_auditd_admin_space_left_action=cis_rhel10 +var_auditd_disk_error_action=cis_rhel10 +var_auditd_disk_full_action=cis_rhel10 +var_auditd_max_log_file=6 +var_auditd_max_log_file_action=keep_logs +var_auditd_space_left_action=cis_rhel10 var_authselect_profile=local +var_multiple_time_servers=rhel var_pam_wheel_group_for_su=cis +var_password_hashing_algorithm=yescrypt +var_password_hashing_algorithm_pam=yescrypt +var_password_pam_dictcheck=1 +var_password_pam_difok=2 +var_password_pam_maxrepeat=3 +var_password_pam_minclass=4 +var_password_pam_minlen=14 +var_password_pam_remember=24 +var_password_pam_remember_control_flag=requisite_or_required var_postfix_inet_interfaces=loopback-only var_screensaver_lock_delay=5_seconds var_selinux_policy_name=targeted @@ -384,3 +444,4 @@ var_sshd_set_keepalive=1 var_sshd_set_login_grace_time=60 var_sshd_set_maxstartups=10:30:60 var_system_crypto_policy=default_policy +var_user_initialization_files_regex=all_dotfiles From f274901c4fd56d76ad53e65c5d245609f6bbd1d2 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 18:49:12 +0200 Subject: [PATCH 19/25] Add more rules to the CIS RHEL10 control file. --- controls/cis_rhel10.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index c8f53ed56a31..21db085c37b6 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -520,6 +520,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - sysctl_fs_protected_hardlinks - id: 1.5.3 title: Ensure fs.protected_symlinks is configured (Automated) @@ -527,6 +529,8 @@ controls: - l2_server - l2_workstation status: automated + rules: + - sysctl_fs_protected_symlinks - id: 1.5.4 title: Ensure fs.suid_dumpable is configured (Automated) @@ -534,6 +538,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - sysctl_fs_suid_dumpable - id: 1.5.5 title: Ensure kernel.dmesg_restrict is configured (Automated) @@ -541,6 +547,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - sysctl_kernel_dmesg_restrict - id: 1.5.6 title: Ensure kernel.kptr_restrict is configured (Automated) @@ -548,6 +556,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - sysctl_kernel_kptr_restrict - id: 1.5.7 title: Ensure kernel.yama.ptrace_scope is configured (Automated) From f4f3e908f056b6aebcba7970dc834a9745708669 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 19:04:07 +0200 Subject: [PATCH 20/25] Update RHEL10 CIS control file. --- controls/cis_rhel10.yml | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index 21db085c37b6..e402cfc13e89 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -759,7 +759,7 @@ controls: levels: - l2_server - l2_workstation - status: automated + status: pending - id: 2.1.1 title: Ensure autofs services are not in use (Automated) @@ -1135,7 +1135,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending - id: 2.4.1.8 title: Ensure access to /etc/cron.d is configured (Automated) @@ -1273,7 +1273,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending - id: 3.3.1.4 title: Ensure net.ipv4.conf.all.send_redirects is configured (Automated) @@ -1648,7 +1648,6 @@ controls: - l1_workstation - l2_server status: automated - notes: New templated rule is necessary for "disableforwarding" option. related_rules: - sshd_disable_tcp_forwarding - sshd_disable_x11_forwarding @@ -1687,7 +1686,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending notes: |- The status was automated but we need to double check the approach used in this rule. Therefore I moved it to pending until deeper investigation. @@ -1725,7 +1724,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending notes: |- The status was automated but we need to double check the approach used in this rule. Therefore I moved it to pending until deeper investigation. @@ -1989,7 +1988,7 @@ controls: levels: - l1_server - l1_workstation - status: manual + status: automated notes: |- This requirement is expected to be manual. However, in previous versions of the policy it was already automated the configuration of "minclass" option. This posture was kept for @@ -2065,7 +2064,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: planned notes: |- A new rule needs to be created to check and remediate the enforce_for_root option in /etc/security/pwhistory.conf. accounts_password_pam_enforce_root can be used as reference. @@ -2099,7 +2098,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending notes: |- Usage of pam_unix.so module together with "remember" option is deprecated and is not recommened by this policy. Instead, it should be used remember option of pam_pwhistory @@ -2225,7 +2224,8 @@ controls: - l1_server - l1_workstation status: automated - notes: New rule is necessary. + rules: + - groups_no_zero_gid_except_root - id: 5.4.2.4 title: Ensure root account access is controlled (Automated) @@ -2252,9 +2252,8 @@ controls: - l1_server - l1_workstation status: automated - notes: |- - There is no rule to ensure umask in /root/.bash_profile and /root/.bashrc. A new rule have - to be created. It can be based on accounts_umask_interactive_users. + rules: + - accounts_umask_root - id: 5.4.2.7 title: Ensure system accounts do not have a valid login shell (Automated) @@ -2280,9 +2279,8 @@ controls: - l2_server - l2_workstation status: automated - notes: |- - It is necessary to create a new rule to check and remove nologin from /etc/shells. - The no_tmux_in_shells rule can be used as referece. + rules: + - no_nologin_in_shells - id: 5.4.3.2 title: Ensure default user shell timeout is configured (Automated) @@ -2364,7 +2362,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending notes: |- It is necessary to create a new rule to check the status of journald and rsyslog. It would also be necessary a new rule to disable or remove rsyslog. From 057c1517593ec98d9735fe6d5e9ffd1064a0bd4a Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 19:11:23 +0200 Subject: [PATCH 21/25] Update RHEL10 CIS Control File. --- controls/cis_rhel10.yml | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index e402cfc13e89..d8adde7e11bd 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -2433,7 +2433,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: supported related_rules: - package_rsyslog_installed @@ -2442,7 +2442,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: supported related_rules: - service_rsyslog_enabled @@ -2451,7 +2451,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: supported related_rules: - journald_forward_to_syslog @@ -2460,7 +2460,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: supported related_rules: - rsyslog_filecreatemode @@ -2485,7 +2485,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: supported related_rules: - rsyslog_nolisten @@ -2904,10 +2904,6 @@ controls: - l2_workstation status: automated rules: - - audit_rules_kernel_module_loading_delete - - audit_rules_kernel_module_loading_finit - - audit_rules_kernel_module_loading_init - - audit_rules_kernel_module_loading_query - audit_rules_privileged_commands_kmod - id: 6.3.3.32 @@ -2916,6 +2912,9 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_kernel_module_loading_init + - audit_rules_kernel_module_loading_finit - id: 6.3.3.33 title: Ensure kernel "delete_module" loading unloading and modification is collected (Automated) @@ -2923,6 +2922,8 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_kernel_module_loading_delete - id: 6.3.3.34 title: Ensure kernel "create_module" and "query_module" loading unloading and modification is collected (Automated) @@ -2930,6 +2931,9 @@ controls: - l2_server - l2_workstation status: automated + rules: + - audit_rules_kernel_module_loading_create + - audit_rules_kernel_module_loading_query - id: 6.3.3.35 title: Ensure the audit configuration is loaded regardless of errors (Automated) From 9a363ab405da17979e7b1d48383384a9338c6ef9 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 19:15:11 +0200 Subject: [PATCH 22/25] Update profile stability data. --- controls/cis_rhel10.yml | 2 +- tests/data/profile_stability/rhel10/cis.profile | 9 +++++++++ .../data/profile_stability/rhel10/cis_server_l1.profile | 6 ++++++ .../profile_stability/rhel10/cis_workstation_l1.profile | 6 ++++++ .../profile_stability/rhel10/cis_workstation_l2.profile | 9 +++++++++ 5 files changed, 31 insertions(+), 1 deletion(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index d8adde7e11bd..cb0f89844b8f 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -495,7 +495,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: pending notes: This requirement demands a deeper review of the rules. rules: - file_groupowner_grub2_cfg diff --git a/tests/data/profile_stability/rhel10/cis.profile b/tests/data/profile_stability/rhel10/cis.profile index e1374084da14..f419fae9fa8d 100644 --- a/tests/data/profile_stability/rhel10/cis.profile +++ b/tests/data/profile_stability/rhel10/cis.profile @@ -30,6 +30,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -60,6 +61,7 @@ audit_rules_file_deletion_events_renameat2 audit_rules_file_deletion_events_unlink audit_rules_file_deletion_events_unlinkat audit_rules_immutable +audit_rules_kernel_module_loading_create audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit audit_rules_kernel_module_loading_init @@ -226,6 +228,7 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_audit_argument grub2_audit_backlog_limit_argument grub2_enable_selinux @@ -272,6 +275,7 @@ no_empty_passwords_etc_shadow no_files_unowned_by_user no_forward_files no_netrc_files +no_nologin_in_shells no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed @@ -361,6 +365,11 @@ sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_protected_symlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects diff --git a/tests/data/profile_stability/rhel10/cis_server_l1.profile b/tests/data/profile_stability/rhel10/cis_server_l1.profile index 7bdcb1bef233..633a3e065265 100644 --- a/tests/data/profile_stability/rhel10/cis_server_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_server_l1.profile @@ -27,6 +27,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -149,6 +150,7 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_enable_selinux grub2_password has_nonlocal_mta @@ -265,6 +267,10 @@ sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile index 370ca60f92ed..cf9e9f04c72a 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile @@ -27,6 +27,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -147,6 +148,7 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_enable_selinux grub2_password has_nonlocal_mta @@ -259,6 +261,10 @@ sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile index c7e233bab75c..10d773eea553 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile @@ -30,6 +30,7 @@ accounts_tmout accounts_umask_etc_bashrc accounts_umask_etc_login_defs accounts_umask_etc_profile +accounts_umask_root accounts_user_dot_group_ownership accounts_user_dot_no_world_writable_programs accounts_user_dot_user_ownership @@ -60,6 +61,7 @@ audit_rules_file_deletion_events_renameat2 audit_rules_file_deletion_events_unlink audit_rules_file_deletion_events_unlinkat audit_rules_immutable +audit_rules_kernel_module_loading_create audit_rules_kernel_module_loading_delete audit_rules_kernel_module_loading_finit audit_rules_kernel_module_loading_init @@ -226,6 +228,7 @@ firewalld_loopback_traffic_trusted gid_passwd_group_same group_unique_id group_unique_name +groups_no_zero_gid_except_root grub2_audit_argument grub2_audit_backlog_limit_argument grub2_enable_selinux @@ -272,6 +275,7 @@ no_empty_passwords_etc_shadow no_files_unowned_by_user no_forward_files no_netrc_files +no_nologin_in_shells no_password_auth_for_systemaccounts no_shelllogin_for_systemaccounts package_aide_installed @@ -358,6 +362,11 @@ sudo_add_use_pty sudo_custom_logfile sudo_require_authentication sudo_require_reauthentication +sysctl_fs_protected_hardlinks +sysctl_fs_protected_symlinks +sysctl_fs_suid_dumpable +sysctl_kernel_dmesg_restrict +sysctl_kernel_kptr_restrict sysctl_kernel_randomize_va_space sysctl_kernel_yama_ptrace_scope sysctl_net_ipv4_conf_all_accept_redirects From b64269c99705c4560927618550d9e042f0abe1a5 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Tue, 9 Sep 2025 19:18:05 +0200 Subject: [PATCH 23/25] Add RHEL10 CCE identifiers. --- .../accounts-restrictions/no_nologin_in_shells/rule.yml | 1 + .../root_logins/groups_no_zero_gid_except_root/rule.yml | 1 + .../accounts-session/user_umask/accounts_umask_root/rule.yml | 1 + .../sysctl_net_ipv6_conf_default_forwarding/rule.yml | 3 ++- shared/references/cce-redhat-avail.txt | 4 ---- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml index 9e5476780f57..9477c5580778 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/no_nologin_in_shells/rule.yml @@ -17,6 +17,7 @@ rationale: |- severity: medium identifiers: + cce@rhel10: CCE-87072-5 cce@sle15: CCE-92592-5 ocil_clause: 'nologin is listed in /etc/shells' diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml index 638f2ac79d84..eed8dfb0c31e 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/groups_no_zero_gid_except_root/rule.yml @@ -15,6 +15,7 @@ rationale: |- severity: high identifiers: + cce@rhel10: CCE-87073-3 cce@sle15: CCE-92565-1 ocil_clause: 'any groups other than "root" have a GID of "0"' diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml index 37f04d6bd5c4..e9f38a6bdc15 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_root/rule.yml @@ -16,6 +16,7 @@ rationale: |- severity: medium identifiers: + cce@rhel10: CCE-87074-1 cce@sle15: CCE-92484-5 platform: package[bash] diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml index 137edcb9f0e4..34b52dee5274 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_forwarding/rule.yml @@ -13,10 +13,11 @@ rationale: |- severity: medium identifiers: + cce@rhel10: CCE-87075-8 cce@sle12: CCE-83248-5 cce@sle15: CCE-85725-0 cce@slmicro5: CCE-93641-9 - cce@slmicro6: CCE-95085-7 + cce@slmicro6: CCE-95085-7 references: nist: CM-6(b),CM-6.1(iv) diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index a9c6403a634e..7b8e3aa90354 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -229,10 +229,6 @@ CCE-87062-6 CCE-87063-4 CCE-87064-2 CCE-87068-3 -CCE-87072-5 -CCE-87073-3 -CCE-87074-1 -CCE-87075-8 CCE-87076-6 CCE-87078-2 CCE-87079-0 From e5b70f48db333bee6a0693c92fc763dd7cc4540d Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Wed, 10 Sep 2025 10:36:24 +0200 Subject: [PATCH 24/25] Align RHEL10 CIS crypt policies rules. --- controls/cis_rhel10.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index cb0f89844b8f..ba12273b4524 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -612,8 +612,10 @@ controls: levels: - l1_server - l1_workstation - status: automated - notes: This requirement is already satisfied by 1.6.1. + status: manual + notes: |- + It is necessary a new rule to ensure a module disabling sha1 in + /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. related_rules: - configure_crypto_policy @@ -622,7 +624,10 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: manual + notes: |- + It is necessary a new rule to ensure a module disabling weak MACs in + /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. related_rules: - configure_crypto_policy @@ -631,7 +636,7 @@ controls: levels: - l1_server - l1_workstation - status: automated + status: manual notes: |- It is necessary a new rule to ensure a module disabling CBC in /etc/crypto-policies/policies/modules/ so it can be used by update-crypto-policies command. From fb3b9a45001393ec53c6a762eac7020b8934b0c6 Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 15 Sep 2025 10:07:41 +0200 Subject: [PATCH 25/25] Update CIS RHEL10 so it doesn't contain wrong statuses. --- controls/cis_rhel10.yml | 8 +++++++- tests/data/profile_stability/rhel10/cis.profile | 3 +++ tests/data/profile_stability/rhel10/cis_server_l1.profile | 3 +++ .../profile_stability/rhel10/cis_workstation_l1.profile | 2 ++ .../profile_stability/rhel10/cis_workstation_l2.profile | 3 +++ 5 files changed, 18 insertions(+), 1 deletion(-) diff --git a/controls/cis_rhel10.yml b/controls/cis_rhel10.yml index ba12273b4524..8c0d9c253a62 100644 --- a/controls/cis_rhel10.yml +++ b/controls/cis_rhel10.yml @@ -108,6 +108,8 @@ controls: - l1_server - l2_workstation status: automated + rules: + - kernel_module_firewire-core_disabled - id: 1.1.1.10 title: Ensure usb-storage kernel module is not available (Automated) @@ -1211,6 +1213,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - kernel_module_atm_disabled - id: 3.2.2 title: Ensure can kernel module is not available (Automated) @@ -1218,6 +1222,8 @@ controls: - l1_server - l1_workstation status: automated + rules: + - kernel_module_can_disabled - id: 3.2.3 title: Ensure dccp kernel module is not available (Automated) @@ -2945,7 +2951,7 @@ controls: levels: - l2_server - l2_workstation - status: automated + status: pending - id: 6.3.3.36 title: Ensure the audit configuration is immutable (Automated) diff --git a/tests/data/profile_stability/rhel10/cis.profile b/tests/data/profile_stability/rhel10/cis.profile index f419fae9fa8d..7e403c75676e 100644 --- a/tests/data/profile_stability/rhel10/cis.profile +++ b/tests/data/profile_stability/rhel10/cis.profile @@ -237,8 +237,11 @@ has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled kernel_module_cramfs_disabled kernel_module_dccp_disabled +kernel_module_firewire-core_disabled kernel_module_freevxfs_disabled kernel_module_hfs_disabled kernel_module_hfsplus_disabled diff --git a/tests/data/profile_stability/rhel10/cis_server_l1.profile b/tests/data/profile_stability/rhel10/cis_server_l1.profile index 633a3e065265..a663b7f4c205 100644 --- a/tests/data/profile_stability/rhel10/cis_server_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_server_l1.profile @@ -157,8 +157,11 @@ has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled kernel_module_cramfs_disabled kernel_module_dccp_disabled +kernel_module_firewire-core_disabled kernel_module_freevxfs_disabled kernel_module_hfs_disabled kernel_module_hfsplus_disabled diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile index cf9e9f04c72a..a6fc83e8a5b5 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l1.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l1.profile @@ -155,6 +155,8 @@ has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled kernel_module_cramfs_disabled kernel_module_dccp_disabled kernel_module_freevxfs_disabled diff --git a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile index 10d773eea553..fe5328336ac5 100644 --- a/tests/data/profile_stability/rhel10/cis_workstation_l2.profile +++ b/tests/data/profile_stability/rhel10/cis_workstation_l2.profile @@ -237,8 +237,11 @@ has_nonlocal_mta inactivity_timeout_value=15_minutes journald_compress journald_storage +kernel_module_atm_disabled +kernel_module_can_disabled kernel_module_cramfs_disabled kernel_module_dccp_disabled +kernel_module_firewire-core_disabled kernel_module_freevxfs_disabled kernel_module_hfs_disabled kernel_module_hfsplus_disabled