From 29eb0f64454f275085015b481a59184e73ebe7f6 Mon Sep 17 00:00:00 2001

From: Shawn Wells <shawn@redhat.com>

Date: Sun, 29 Mar 2020 00:58:02 -0400

Subject: [PATCH 01/20] update CIS RHEL8 profile

---

 .../service_crond_enabled/rule.yml            |   2 +-

 .../r_services/no_rsh_trust_files/rule.yml    |   8 +-

 .../rule.yml                                  |   2 +-

 .../account_unique_name/rule.yml              |  11 +-

 .../accounts_maximum_age_login_defs/rule.yml  |   2 +-

 .../accounts_minimum_age_login_defs/rule.yml  |   1 +

 .../rule.yml                                  |   1 +

 .../var_accounts_maximum_age_login_defs.var   |   1 +

 .../password_storage/no_netrc_files/rule.yml  |   4 +-

 .../accounts_no_uid_except_zero/rule.yml      |   2 +-

 .../no_direct_root_logins/rule.yml            |   2 +-

 .../rule.yml                                  |   1 +

 .../accounts-session/accounts_tmout/rule.yml  |   1 +

 .../rule.yml                                  |   1 +

 .../rule.yml                                  |   1 +

 .../file_permissions_home_dirs/rule.yml       |   4 +-

 .../rsyslog_files_permissions/rule.yml        |   2 +-

 .../ensure_logrotate_activated/rule.yml       |   1 +

 .../package_rsyslog_installed/rule.yml        |   2 +-

 .../rsyslog_nolisten/rule.yml                 |   2 +

 .../rsyslog_remote_loghost/rule.yml           |   4 +-

 .../logging/service_rsyslog_enabled/rule.yml  |   2 +-

 rhel8/profiles/cis.profile                    | 141 ++++++++++++------

 shared/references/cce-redhat-avail.txt        |   2 -

 24 files changed, 137 insertions(+), 63 deletions(-)

diff --git a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml

index a1f82cf5c9..09d1a92a55 100644

--- a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml

+++ b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml

@@ -24,7 +24,7 @@ identifiers:

 references:

     stigid@rhel6: "000224"

     srg@rhel6: SRG-OS-999999

-    cis: 5.1.1

+    cis@rhel8: 5.1.1

     hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)

     nist: CM-6(a)

     nist-csf: PR.IP-1,PR.PT-3

diff --git a/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml b/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml

index 2ccf4127b7..ec2fa6c012 100644

--- a/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml

+++ b/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml

@@ -12,9 +12,9 @@ description: |-

     
$ rm ~/.rhosts

 rationale: |-

-    Trust files are convenient, but when

-    used in conjunction with the R-services, they can allow

-    unauthenticated access to a system.

+    This action is only meaningful if <tt>.rhosts</tt> support is permitted

+    through PAM. Trust files are convenient, but when used in conjunction with

+    the R-services, they can allow unauthenticated access to a system.

 severity: high

@@ -26,7 +26,7 @@ identifiers:

 references:

     stigid@rhel6: "000019"

     srg@rhel6: SRG-OS-000248

-    cis: 6.2.14

+    cis@rhel8: 6.2.13

     disa: "1436"

     hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)

     nist: CM-7(a),CM-7(b),CM-6(a)

diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml

index fff30d70c7..7a1538392a 100644

--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml

@@ -43,7 +43,7 @@ references:

     stigid@rhel6: "000062"

     srg@rhel6: SRG-OS-000120

     disa@rhel6: '803'

-    cis: 6.3.1

+    cis@rhel8: 5.4.4

     cjis: 5.6.2.2

     cui: 3.13.11

     disa: "196"

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml

index 2cdafc0609..35652a410b 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml

@@ -2,9 +2,15 @@ documentation_complete: true

 title: 'Ensure All Accounts on the System Have Unique Names'

-description: 'Change usernames, or delete accounts, so each has a unique name.'

+description: |-

+    Although the <tt>useradd</tt> utility prevents creation of duplicate user

+    names, it is possible for a malicious administrator to manually edit the

+    <tt>/etc/passwd</tt> file and change the user name.

-rationale: 'Unique usernames allow for accountability on the system.'

+rationale: |-

+    If a user is assigned a duplicate user name, the new user will be able to

+    create and have access to files with the first UID for that username as

+    defined in <tt>/etc/passwd</tt>.

 severity: medium

@@ -19,6 +25,7 @@ references:

     cjis: 5.5.2

     disa: 770,804

     pcidss: Req-8.1.1

+    cis@rhel8: 6.2.17

 ocil_clause: 'a line is returned'

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml

index af1ea13d8f..c2c4aa11bc 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml

@@ -34,7 +34,7 @@ references:

     stigid@rhel6: "000053"

     srg@rhel6: SRG-OS-000076

     disa@rhel6: '180'

-    cis: 5.4.1.1

+    cis@rhel8: 5.5.1.1

     cjis: 5.6.2.1

     cui: 3.5.6

     disa: "199"

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml

index 2de12efb3e..6147d672a4 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml

@@ -44,6 +44,7 @@ references:

     cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10

     iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3

     cis-csc: 1,12,15,16,5

+    cis@rhel8: 5.5.1.2

 ocil_clause: 'it is not equal to or greater than the required value'

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml

index 3a5c00708d..2a1005bd20 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml

@@ -33,6 +33,7 @@ references:

     cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10

     iso27001-2013: A.12.4.1,A.12.4.3,A.18.1.4,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5

     cis-csc: 1,12,13,14,15,16,18,3,5,7,8

+    cis@rhel8: 5.5.1.3

 ocil_clause: 'it is not set to the required value'

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var

index 731f8f475f..11eb238c5d 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var

+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var

@@ -9,6 +9,7 @@ type: number

 interactive: false

 options:

+    365: 365

     120: 120

     180: 180

     60: 60

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml

index 01454a7274..8547893201 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml

@@ -11,8 +11,7 @@ description: |-

 rationale: |-

     Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>

-    files. DoD policy requires passwords be encrypted in storage and not used

-    in access scripts.

+    files. 

 severity: medium

@@ -24,6 +23,7 @@ identifiers:

 references:

     stigid@rhel6: "000347"

     srg@rhel6: SRG-OS-000073

+    cis@rhel8: 6.2.11

     disa: "196"

     nist: IA-5(h),IA-5(1)(c),CM-6(a),IA-5(7)

     nist-csf: PR.AC-1,PR.AC-4,PR.AC-6,PR.AC-7,PR.PT-3

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml

index 0b61daf925..14f9140687 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml

@@ -31,7 +31,7 @@ references:

     stigid@ol7: "020310"

     stigid@rhel6: "000032"

     srg@rhel6: SRG-OS-999999

-    cis: 6.2.5

+    cis@rhel8: 6.2.6

     cui: 3.1.1,3.1.5

     disa: "366"

     nist: IA-2,AC-6(5),IA-4(b)

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml

index 1d08bde4d9..9e00f3aad6 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml

@@ -33,7 +33,7 @@ identifiers:

     cce@ocp4: 82698-2

 references:

-    cis: "5.5"

+    cis@rhel8: "5.6"

     cui: 3.1.1,3.1.6

     hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)

     nist: IA-2,CM-6(a)

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml

index ae8ba133b7..0c26ac3240 100644

--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml

@@ -35,6 +35,7 @@ references:

     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02

     iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5

     cis-csc: 12,13,14,15,16,18,3,5

+    cis@rhel8: "5.6"

     srg: SRG-OS-000324-GPOS-00125

 ocil_clause: 'root login over virtual console devices is permitted'

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml

index 787f2264de..f09006b72b 100644

--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml

@@ -38,6 +38,7 @@ references:

     cobit5: DSS05.04,DSS05.10,DSS06.10

     iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3

     cis-csc: 1,12,15,16

+    cis@rhel8: 5.5.3

     anssi: NT28(R29)

 ocil_clause: 'value of TMOUT is not less than or equal to expected setting'

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml

index e7e9a751a4..bedf3a0b19 100644

--- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml

@@ -27,6 +27,7 @@ references:

     disa: "366"

     srg: SRG-OS-000480-GPOS-00227

     stigid@rhel7: "020620"

+    cis@rhel8: 6.2.20

 ocil_clause: 'users home directory does not exist'

diff --git a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml

index d58884235e..1c5ac8d099 100644

--- a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml

@@ -26,6 +26,7 @@ references:

     disa: "366"

     srg: SRG-OS-000480-GPOS-00227

     stigid@rhel7: "020650"

+    cis@rhel8: 6.2.8

 ocil_clause: 'the group ownership is incorrect'

diff --git a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml

index 8812f9d123..27c190b5b1 100644

--- a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml

@@ -22,11 +22,12 @@ rationale: |-

     to one another's home directories, this can be provided using

     groups or ACLs.

-severity: unknown

+severity: medium

 identifiers:

     cce@rhel6: 26981-1

     cce@rhel7: 80201-7

+    cce@rhel8: 84274-0

 references:

     disa: "225"

@@ -37,6 +38,7 @@ references:

     cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02

     iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5

     cis-csc: 12,13,14,15,16,18,3,5

+    cis@rhel8: 6.2.7

 ocil_clause: 'the user home directory is group-writable or world-readable'

diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml

index 4c1e69020b..aa6e0905ae 100644

--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml

+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml

@@ -31,7 +31,7 @@ references:

     anssi: NT28(R36)

     stigid@rhel6: "000135"

     srg@rhel6: SRG-OS-000206

-    cis: 4.2.1.3

+    cis@rhel8: 4.2.1.3

     disa: "1314"

     nist: CM-6(a),AC-6(1)

     pcidss: Req-10.5.1,Req-10.5.2

diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml

index def9566692..2c41a3b9ef 100644

--- a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml

+++ b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml

@@ -35,6 +35,7 @@ references:

     cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01

     iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1

     cis-csc: 1,14,15,16,3,5,6

+    cis@rhel8: 4.3

     anssi: NT28(R43),NT12(R18)

 ocil_clause: 'logrotate is not configured to run daily'

diff --git a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml

index 9f00dd9704..00fecf8a3c 100644

--- a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml

+++ b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml

@@ -18,7 +18,7 @@ identifiers:

 references:

     cis@debian8: 5.1.1

     anssi: NT28(R5),NT28(R46)

-    cis: 4.2.3

+    cis@rhel8: 4.2.1.1

     disa: 1311,1312

     hipaa: 164.312(a)(2)(ii)

     iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1

diff --git a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml

index 8a5a15e1da..14e729252c 100644

--- a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml

+++ b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml

@@ -26,6 +26,7 @@ severity: medium

 identifiers:

     cce@rhel6: 26803-7

     cce@rhel7: 80192-8

+    cce@rhel8: 84275-7

 references:

     stigid@ol7: "031010"

@@ -39,3 +40,4 @@ references:

     iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.5.1,A.12.6.2,A.12.7.1,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5

     cis-csc: 1,11,12,13,14,15,16,18,3,4,5,6,8,9

     stigid@rhel7: "031010"

+    cis@rhel8: 4.2.1.6

diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml

index 7b70b0c186..da28b99561 100644

--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml

+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml

@@ -46,8 +46,8 @@ references:

     anssi: NT28(R7),NT28(R43),NT12(R5)

     stigid@rhel6: "000136"

     srg@rhel6: SRG-OS-000043,SRG-OS-000215

-    cis: 4.2.1.4

-    disa: 136,366,1348,1851

+    cis@rhel8: 4.2.1.5

+    disa: 366,1348,136,1851

     hipaa: 164.308(a)(1)(ii)(D),164.308(a)(5)(ii)(B),164.308(a)(5)(ii)(C),164.308(a)(6)(ii),164.308(a)(8),164.310(d)(2)(iii),164.312(b),164.314(a)(2)(i)(C),164.314(a)(2)(iii)

     iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.17.2.1

     nist: CM-6(a),AU-4(1),AU-9(2)

diff --git a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml

index ce8347c686..92fd6bc4d8 100644

--- a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml

+++ b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml

@@ -20,7 +20,7 @@ identifiers:

 references:

     cis@debian8: 5.1.2

     anssi: NT28(R5),NT28(R46)

-    cis: 4.2.1.1

+    cis@rhel8: 4.2.1.2

     disa: 1311,1312,1557,1851

     hipaa: 164.312(a)(2)(ii)

     iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.14.2.7,A.15.2.1,A.15.2.2,A.17.2.1

diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile

index cc0c2a5b9a..528f17d696 100644

--- a/rhel8/profiles/cis.profile

+++ b/rhel8/profiles/cis.profile

@@ -602,87 +602,88 @@ selections:

     ### 4.1.9 Ensure discretionary access control permission modification

     ###       events are collected (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5509

     ### 4.1.10 Ensure unsuccessful unauthorized file access attempts are

     ###        collected (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5510

     ### 4.1.11 Ensure events that modify user/group information are

     ###        collected (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5511

     ### 4.1.12 Ensure successful file system mounts are collected (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5512

     ### 4.1.13 Ensure use of privileged commands is collected (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5513

     ### 4.1.14 Ensure file deletion events by users are collected

     ###        (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5514

     ### 4.1.15 Ensure kernel module loading and unloading is collected

     ###        (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5515

     ### 4.1.16 Ensure system administrator actions (sudolog) are

     ###        collected (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5516

     ### 4.1.17 Ensure the audit configuration is immutable (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5517

     ## 4.2 Configure Logging

     ### 4.2.1 Configure rsyslog

     #### 4.2.1.1 Ensure rsyslog is installed (Scored)

-

+    - package_rsyslog_installed

     #### 4.2.1.2 Ensure rsyslog Service is enabled (Scored)

-

+    - service_rsyslog_enabled

     #### 4.2.1.3 Ensure rsyslog default file permissions configured (Scored)

-

+    - rsyslog_files_permissions

     #### 4.2.1.4 Ensure logging is configured (Not Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5519

     #### 4.2.1.5 Ensure rsyslog is configured to send logs to a remote

     ####         log host (Scored)   

-

+    - rsyslog_remote_loghost

     #### 4.2.1.6 Ensure remote rsyslog messages are only accepted on

     ####         designated log hosts (Not Scored)

-

+    - rsyslog_nolisten

     ### 4.2.2 Configure journald

     #### 4.2.2.1 Ensure journald is configured to send logs to

     ####         rsyslog (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5520

     #### 4.2.2.2 Ensure journald is configured to compress large

     ####         log files (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5521

     #### 4.2.2.3 Ensure journald is configured to write logfiles to

     ####         persistent disk (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5522

     ### 4.2.3 Ensure permissions on all logfiles are configured (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5523

     ## 4.3 Ensure logrotate is conifgured (Not Scored)

-

+    - ensure_logrotate_activated

     # 5 Access, Authentication and Authorization

     ## 5.1 Configure cron

-

     ### 5.1.1 Ensure cron daemon is enabled (Scored)

+    - service_crond_enabled

     ### 5.1.2 Ensure permissions on /etc/crontab are configured (Scored)

@@ -790,19 +791,19 @@ selections:

     ### 5.2.14 Ensure SSH LoginGraceTime is set to one minute

     ###        or less (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5525

     ### 5.2.15 Ensure SSH warning banner is configured (Scored)

     - sshd_enable_warning_banner

     ### 5.2.16 Ensure SSH PAM is enabled (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5526

     ### 5.2.17 Ensure SSH AllowTcpForwarding is disabled (Scored)

     - sshd_disable_tcp_forwarding

     ### 5.2.18 Ensure SSH MaxStarups is configured (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5528

     ### 5.2.19 Ensure SSH MaxSessions is set to 4 or less (Scored)

     - sshd_set_max_sessions

@@ -815,69 +816,75 @@ selections:

     ### 5.3.1 Create custom authselectet profile (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5530

     ### 5.3.2 Select authselect profile (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5531

     ### 5.3.3 Ensure authselect includes with-faillock (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5532

     ## 5.4 Configure PAM

     ### 5.4.1 Ensure password creation requirements are configured (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5533

     ### 5.4.2 Ensure lockout for failed password attempts is

     ###       configured (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5534

     ### 5.4.3 Ensure password reuse is limited (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5535

     ### 5.4.4 Ensure password hashing algorithm is SHA-512 (Scored)

-

+    - set_password_hashing_algorithm_systemauth

     ## 5.5 User Accounts and Environment

     ### 5.5.1 Set Shadow Password Suite Parameters

     #### 5.5.1 Ensure password expiration is 365 days or less (Scored)

-

+    - var_accounts_maximum_age_login_defs=365

+    - accounts_maximum_age_login_defs

     #### 5.5.1.2 Ensure minimum days between password changes is 7

     ####         or more (Scored)

-

+    - var_accounts_minimum_age_login_defs=7

+    - accounts_minimum_age_login_defs

     #### 5.5.1.3 Ensure password expiration warning days is

     ####         7 or more (Scored)

-

+    - var_accounts_password_warn_age_login_defs=7

+    - accounts_password_warn_age_login_defs

     #### 5.5.1.4 Ensure inactive password lock is 30 days or less (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5536

     #### 5.5.1.5 Ensure all users last password change date is

     ####         in the past (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5537

     ### 5.5.2 Ensure system accounts are secured (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5538

     ### 5.5.3 Ensure default user shell timeout is 900 seconds

     ###       or less (Scored)

-

+    - var_accounts_tmout=15_min

+    - accounts_tmout

     ### 5.5.4 Ensure default group for the root account is

     ###       GID 0 (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5539

     ### 5.5.5 Ensure default user mask is 027 or more restrictive (Scored)

-

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5540

     ## 5.6 Ensure root login is restricted to system console (Not Scored)

-

+    - securetty_root_login_console_only

+    - no_direct_root_logins

     ## 5.7 Ensure access to the su command is restricted (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5541

     # System Maintenance

@@ -971,8 +978,58 @@ selections:

     ### 6.2.2 Ensure no legacy "+" entries exist in /etc/passwd (Scored)

     - no_legacy_plus_entries_etc_passwd

-    ## 6.2.4 Ensure no legacy "+" entries exist in /etc/shadow (Scored)

+    ### 6.2.4 Ensure no legacy "+" entries exist in /etc/shadow (Scored)

     - no_legacy_plus_entries_etc_shadow

-    ###6.2.5 Ensure no legacy "+" entries exist in /etc/group (Scored)

+    ### 6.2.5 Ensure no legacy "+" entries exist in /etc/group (Scored)

     - no_legacy_plus_entries_etc_group

+

+    ### 6.2.6 Ensure root is the only UID 0 account (Scored)

+    - accounts_no_uid_except_zero

+

+    ### 6.2.7 Ensure users' home directories permissions are 750

+    ###       or more restrictive (Scored)

+    - file_permissions_home_dirs

+

+    ### 6.2.8 Ensure users own their home directories (Scored)

+    # NEEDS RULE for user owner @ https://github.com/ComplianceAsCode/content/issues/5507

+    - file_groupownership_home_directories

+

+    ### 6.2.9 Ensure users' dot files are not group or world

+    ###       writable (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5506

+

+    ### 6.2.10 Ensure no users have .forward files (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5505

+

+    ### 6.2.11 Ensure no users have .netrc files (Scored)

+    - no_netrc_files

+

+    ### 6.2.12 Ensure users' .netrc Files are not group or

+    ###        world accessible (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5504

+

+    ### 6.2.13 Ensure no users have .rhosts files (Scored)

+    - no_rsh_trust_files

+

+    ### 6.2.14 Ensure all groups in /etc/passwd exist in

+    ###        /etc/group (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5503

+

+    ### 6.2.15 Ensure no duplicate UIDs exist (Scored)

+    # NEEDS RULE -  https://github.com/ComplianceAsCode/content/issues/5502

+

+    ### 6.2.16 Ensure no duplicate GIDs exist (Scored)

+    # NEEDS RULE -  https://github.com/ComplianceAsCode/content/issues/5501

+

+    ### 6.2.17 Ensure no duplicate user names exist (Scored)

+    - account_unique_name

+

+    ### 6.2.18 Ensure no duplicate group names exist (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5500

+

+    ### 6.2.19 Ensure shadow group is empty (Scored)

+    # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5499

+

+    ### 6.2.20 Ensure all users' home directories exist (Scored)

+    - accounts_user_interactive_home_directory_exists

diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt

index feb31b0395..9e7bd35178 100644

--- a/shared/references/cce-redhat-avail.txt

+++ b/shared/references/cce-redhat-avail.txt

@@ -901,8 +901,6 @@ CCE-84270-8

 CCE-84271-6

 CCE-84272-4

 CCE-84273-2

-CCE-84274-0

-CCE-84275-7

 CCE-84276-5

 CCE-84277-3

 CCE-84278-1

From c8a19c84dad5165ece50f6148646f9bbc8c4c3fd Mon Sep 17 00:00:00 2001

From: Shawn Wells <shawn@shawndwells.io>

Date: Sat, 25 Apr 2020 18:52:21 -0400

Subject: [PATCH 02/20] misc cis8 updates

---

 .../accounts_users_home_files_ownership/rule.yml                | 1 +

 .../logging/log_rotation/ensure_logrotate_activated/rule.yml    | 2 +-

 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml

index a9c73e46ac..8e225cdc64 100644

--- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml

+++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml

@@ -24,6 +24,7 @@ references:

     stigid@ol7: "020660"

     disa: "366"

     srg: SRG-OS-000480-GPOS-00227

+    cis@rhel8: 6.2.8

     stigid@rhel7: "020660"

 ocil_clause: 'the user ownership is incorrect'

diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml

index 2c41a3b9ef..6e569edfa9 100644

--- a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml

+++ b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml

@@ -35,7 +35,7 @@ references:

     cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01

     iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1

     cis-csc: 1,14,15,16,3,5,6

-    cis@rhel8: 4.3

+    cis@rhel8: "4.3"

     anssi: NT28(R43),NT12(R18)

 ocil_clause: 'logrotate is not configured to run daily'

From f8d80a55f0cd6bf3b9bf5b75ba037466b7fc89c8 Mon Sep 17 00:00:00 2001

From: Watson Sato <wsato@redhat.com>

Date: Tue, 19 May 2020 22:32:44 +0200

Subject: [PATCH 03/20] Add auxiliary rule for dconf settings

---

 rhel8/profiles/cis.profile | 2 ++

 1 file changed, 2 insertions(+)

diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile

index 528f17d696..202db7f693 100644