From 29eb0f64454f275085015b481a59184e73ebe7f6 Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn@redhat.com>
Date: Sun, 29 Mar 2020 00:58:02 -0400
Subject: [PATCH 01/20] update CIS RHEL8 profile
---
.../service_crond_enabled/rule.yml | 2 +-
.../r_services/no_rsh_trust_files/rule.yml | 8 +-
.../rule.yml | 2 +-
.../account_unique_name/rule.yml | 11 +-
.../accounts_maximum_age_login_defs/rule.yml | 2 +-
.../accounts_minimum_age_login_defs/rule.yml | 1 +
.../rule.yml | 1 +
.../var_accounts_maximum_age_login_defs.var | 1 +
.../password_storage/no_netrc_files/rule.yml | 4 +-
.../accounts_no_uid_except_zero/rule.yml | 2 +-
.../no_direct_root_logins/rule.yml | 2 +-
.../rule.yml | 1 +
.../accounts-session/accounts_tmout/rule.yml | 1 +
.../rule.yml | 1 +
.../rule.yml | 1 +
.../file_permissions_home_dirs/rule.yml | 4 +-
.../rsyslog_files_permissions/rule.yml | 2 +-
.../ensure_logrotate_activated/rule.yml | 1 +
.../package_rsyslog_installed/rule.yml | 2 +-
.../rsyslog_nolisten/rule.yml | 2 +
.../rsyslog_remote_loghost/rule.yml | 4 +-
.../logging/service_rsyslog_enabled/rule.yml | 2 +-
rhel8/profiles/cis.profile | 141 ++++++++++++------
shared/references/cce-redhat-avail.txt | 2 -
24 files changed, 137 insertions(+), 63 deletions(-)
diff --git a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml
index a1f82cf5c9..09d1a92a55 100644
--- a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml
+++ b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml
@@ -24,7 +24,7 @@ identifiers:
references:
stigid@rhel6: "000224"
srg@rhel6: SRG-OS-999999
- cis: 5.1.1
+ cis@rhel8: 5.1.1
hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
nist: CM-6(a)
nist-csf: PR.IP-1,PR.PT-3
diff --git a/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml b/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml
index 2ccf4127b7..ec2fa6c012 100644
--- a/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml
+++ b/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml
@@ -12,9 +12,9 @@ description: |-
<pre>$ rm ~/.rhosts</pre>
rationale: |-
- Trust files are convenient, but when
- used in conjunction with the R-services, they can allow
- unauthenticated access to a system.
+ This action is only meaningful if <tt>.rhosts</tt> support is permitted
+ through PAM. Trust files are convenient, but when used in conjunction with
+ the R-services, they can allow unauthenticated access to a system.
severity: high
@@ -26,7 +26,7 @@ identifiers:
references:
stigid@rhel6: "000019"
srg@rhel6: SRG-OS-000248
- cis: 6.2.14
+ cis@rhel8: 6.2.13
disa: "1436"
hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
nist: CM-7(a),CM-7(b),CM-6(a)
diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
index fff30d70c7..7a1538392a 100644
--- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml
@@ -43,7 +43,7 @@ references:
stigid@rhel6: "000062"
srg@rhel6: SRG-OS-000120
disa@rhel6: '803'
- cis: 6.3.1
+ cis@rhel8: 5.4.4
cjis: 5.6.2.2
cui: 3.13.11
disa: "196"
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
index 2cdafc0609..35652a410b 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
@@ -2,9 +2,15 @@ documentation_complete: true
title: 'Ensure All Accounts on the System Have Unique Names'
-description: 'Change usernames, or delete accounts, so each has a unique name.'
+description: |-
+ Although the <tt>useradd</tt> utility prevents creation of duplicate user
+ names, it is possible for a malicious administrator to manually edit the
+ <tt>/etc/passwd</tt> file and change the user name.
-rationale: 'Unique usernames allow for accountability on the system.'
+rationale: |-
+ If a user is assigned a duplicate user name, the new user will be able to
+ create and have access to files with the first UID for that username as
+ defined in <tt>/etc/passwd</tt>.
severity: medium
@@ -19,6 +25,7 @@ references:
cjis: 5.5.2
disa: 770,804
pcidss: Req-8.1.1
+ cis@rhel8: 6.2.17
ocil_clause: 'a line is returned'
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml
index af1ea13d8f..c2c4aa11bc 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml
@@ -34,7 +34,7 @@ references:
stigid@rhel6: "000053"
srg@rhel6: SRG-OS-000076
disa@rhel6: '180'
- cis: 5.4.1.1
+ cis@rhel8: 5.5.1.1
cjis: 5.6.2.1
cui: 3.5.6
disa: "199"
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml
index 2de12efb3e..6147d672a4 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml
@@ -44,6 +44,7 @@ references:
cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3
cis-csc: 1,12,15,16,5
+ cis@rhel8: 5.5.1.2
ocil_clause: 'it is not equal to or greater than the required value'
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml
index 3a5c00708d..2a1005bd20 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml
@@ -33,6 +33,7 @@ references:
cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
iso27001-2013: A.12.4.1,A.12.4.3,A.18.1.4,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5
cis-csc: 1,12,13,14,15,16,18,3,5,7,8
+ cis@rhel8: 5.5.1.3
ocil_clause: 'it is not set to the required value'
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var
index 731f8f475f..11eb238c5d 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var
@@ -9,6 +9,7 @@ type: number
interactive: false
options:
+ 365: 365
120: 120
180: 180
60: 60
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml
index 01454a7274..8547893201 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml
@@ -11,8 +11,7 @@ description: |-
rationale: |-
Unencrypted passwords for remote FTP servers may be stored in <tt>.netrc</tt>
- files. DoD policy requires passwords be encrypted in storage and not used
- in access scripts.
+ files.
severity: medium
@@ -24,6 +23,7 @@ identifiers:
references:
stigid@rhel6: "000347"
srg@rhel6: SRG-OS-000073
+ cis@rhel8: 6.2.11
disa: "196"
nist: IA-5(h),IA-5(1)(c),CM-6(a),IA-5(7)
nist-csf: PR.AC-1,PR.AC-4,PR.AC-6,PR.AC-7,PR.PT-3
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml
index 0b61daf925..14f9140687 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml
@@ -31,7 +31,7 @@ references:
stigid@ol7: "020310"
stigid@rhel6: "000032"
srg@rhel6: SRG-OS-999999
- cis: 6.2.5
+ cis@rhel8: 6.2.6
cui: 3.1.1,3.1.5
disa: "366"
nist: IA-2,AC-6(5),IA-4(b)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml
index 1d08bde4d9..9e00f3aad6 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml
@@ -33,7 +33,7 @@ identifiers:
cce@ocp4: 82698-2
references:
- cis: "5.5"
+ cis@rhel8: "5.6"
cui: 3.1.1,3.1.6
hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii)
nist: IA-2,CM-6(a)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml
index ae8ba133b7..0c26ac3240 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml
@@ -35,6 +35,7 @@ references:
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
cis-csc: 12,13,14,15,16,18,3,5
+ cis@rhel8: "5.6"
srg: SRG-OS-000324-GPOS-00125
ocil_clause: 'root login over virtual console devices is permitted'
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
index 787f2264de..f09006b72b 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml
@@ -38,6 +38,7 @@ references:
cobit5: DSS05.04,DSS05.10,DSS06.10
iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3
cis-csc: 1,12,15,16
+ cis@rhel8: 5.5.3
anssi: NT28(R29)
ocil_clause: 'value of TMOUT is not less than or equal to expected setting'
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml
index e7e9a751a4..bedf3a0b19 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml
@@ -27,6 +27,7 @@ references:
disa: "366"
srg: SRG-OS-000480-GPOS-00227
stigid@rhel7: "020620"
+ cis@rhel8: 6.2.20
ocil_clause: 'users home directory does not exist'
diff --git a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml
index d58884235e..1c5ac8d099 100644
--- a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml
@@ -26,6 +26,7 @@ references:
disa: "366"
srg: SRG-OS-000480-GPOS-00227
stigid@rhel7: "020650"
+ cis@rhel8: 6.2.8
ocil_clause: 'the group ownership is incorrect'
diff --git a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml
index 8812f9d123..27c190b5b1 100644
--- a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml
@@ -22,11 +22,12 @@ rationale: |-
to one another's home directories, this can be provided using
groups or ACLs.
-severity: unknown
+severity: medium
identifiers:
cce@rhel6: 26981-1
cce@rhel7: 80201-7
+ cce@rhel8: 84274-0
references:
disa: "225"
@@ -37,6 +38,7 @@ references:
cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02
iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
cis-csc: 12,13,14,15,16,18,3,5
+ cis@rhel8: 6.2.7
ocil_clause: 'the user home directory is group-writable or world-readable'
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml
index 4c1e69020b..aa6e0905ae 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml
@@ -31,7 +31,7 @@ references:
anssi: NT28(R36)
stigid@rhel6: "000135"
srg@rhel6: SRG-OS-000206
- cis: 4.2.1.3
+ cis@rhel8: 4.2.1.3
disa: "1314"
nist: CM-6(a),AC-6(1)
pcidss: Req-10.5.1,Req-10.5.2
diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml
index def9566692..2c41a3b9ef 100644
--- a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml
+++ b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml
@@ -35,6 +35,7 @@ references:
cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01
iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1
cis-csc: 1,14,15,16,3,5,6
+ cis@rhel8: 4.3
anssi: NT28(R43),NT12(R18)
ocil_clause: 'logrotate is not configured to run daily'
diff --git a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
index 9f00dd9704..00fecf8a3c 100644
--- a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
+++ b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml
@@ -18,7 +18,7 @@ identifiers:
references:
cis@debian8: 5.1.1
anssi: NT28(R5),NT28(R46)
- cis: 4.2.3
+ cis@rhel8: 4.2.1.1
disa: 1311,1312
hipaa: 164.312(a)(2)(ii)
iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1
diff --git a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml
index 8a5a15e1da..14e729252c 100644
--- a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml
+++ b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml
@@ -26,6 +26,7 @@ severity: medium
identifiers:
cce@rhel6: 26803-7
cce@rhel7: 80192-8
+ cce@rhel8: 84275-7
references:
stigid@ol7: "031010"
@@ -39,3 +40,4 @@ references:
iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.5.1,A.12.6.2,A.12.7.1,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5
cis-csc: 1,11,12,13,14,15,16,18,3,4,5,6,8,9
stigid@rhel7: "031010"
+ cis@rhel8: 4.2.1.6
diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
index 7b70b0c186..da28b99561 100644
--- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
+++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml
@@ -46,8 +46,8 @@ references:
anssi: NT28(R7),NT28(R43),NT12(R5)
stigid@rhel6: "000136"
srg@rhel6: SRG-OS-000043,SRG-OS-000215
- cis: 4.2.1.4
- disa: 136,366,1348,1851
+ cis@rhel8: 4.2.1.5
+ disa: 366,1348,136,1851
hipaa: 164.308(a)(1)(ii)(D),164.308(a)(5)(ii)(B),164.308(a)(5)(ii)(C),164.308(a)(6)(ii),164.308(a)(8),164.310(d)(2)(iii),164.312(b),164.314(a)(2)(i)(C),164.314(a)(2)(iii)
iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.17.2.1
nist: CM-6(a),AU-4(1),AU-9(2)
diff --git a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml
index ce8347c686..92fd6bc4d8 100644
--- a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml
+++ b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml
@@ -20,7 +20,7 @@ identifiers:
references:
cis@debian8: 5.1.2
anssi: NT28(R5),NT28(R46)
- cis: 4.2.1.1
+ cis@rhel8: 4.2.1.2
disa: 1311,1312,1557,1851
hipaa: 164.312(a)(2)(ii)
iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.14.2.7,A.15.2.1,A.15.2.2,A.17.2.1
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index cc0c2a5b9a..528f17d696 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -602,87 +602,88 @@ selections:
### 4.1.9 Ensure discretionary access control permission modification
### events are collected (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5509
### 4.1.10 Ensure unsuccessful unauthorized file access attempts are
### collected (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5510
### 4.1.11 Ensure events that modify user/group information are
### collected (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5511
### 4.1.12 Ensure successful file system mounts are collected (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5512
### 4.1.13 Ensure use of privileged commands is collected (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5513
### 4.1.14 Ensure file deletion events by users are collected
### (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5514
### 4.1.15 Ensure kernel module loading and unloading is collected
### (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5515
### 4.1.16 Ensure system administrator actions (sudolog) are
### collected (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5516
### 4.1.17 Ensure the audit configuration is immutable (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5517
## 4.2 Configure Logging
### 4.2.1 Configure rsyslog
#### 4.2.1.1 Ensure rsyslog is installed (Scored)
-
+ - package_rsyslog_installed
#### 4.2.1.2 Ensure rsyslog Service is enabled (Scored)
-
+ - service_rsyslog_enabled
#### 4.2.1.3 Ensure rsyslog default file permissions configured (Scored)
-
+ - rsyslog_files_permissions
#### 4.2.1.4 Ensure logging is configured (Not Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5519
#### 4.2.1.5 Ensure rsyslog is configured to send logs to a remote
#### log host (Scored)
-
+ - rsyslog_remote_loghost
#### 4.2.1.6 Ensure remote rsyslog messages are only accepted on
#### designated log hosts (Not Scored)
-
+ - rsyslog_nolisten
### 4.2.2 Configure journald
#### 4.2.2.1 Ensure journald is configured to send logs to
#### rsyslog (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5520
#### 4.2.2.2 Ensure journald is configured to compress large
#### log files (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5521
#### 4.2.2.3 Ensure journald is configured to write logfiles to
#### persistent disk (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5522
### 4.2.3 Ensure permissions on all logfiles are configured (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5523
## 4.3 Ensure logrotate is conifgured (Not Scored)
-
+ - ensure_logrotate_activated
# 5 Access, Authentication and Authorization
## 5.1 Configure cron
-
### 5.1.1 Ensure cron daemon is enabled (Scored)
+ - service_crond_enabled
### 5.1.2 Ensure permissions on /etc/crontab are configured (Scored)
@@ -790,19 +791,19 @@ selections:
### 5.2.14 Ensure SSH LoginGraceTime is set to one minute
### or less (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5525
### 5.2.15 Ensure SSH warning banner is configured (Scored)
- sshd_enable_warning_banner
### 5.2.16 Ensure SSH PAM is enabled (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5526
### 5.2.17 Ensure SSH AllowTcpForwarding is disabled (Scored)
- sshd_disable_tcp_forwarding
### 5.2.18 Ensure SSH MaxStarups is configured (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5528
### 5.2.19 Ensure SSH MaxSessions is set to 4 or less (Scored)
- sshd_set_max_sessions
@@ -815,69 +816,75 @@ selections:
### 5.3.1 Create custom authselectet profile (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5530
### 5.3.2 Select authselect profile (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5531
### 5.3.3 Ensure authselect includes with-faillock (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5532
## 5.4 Configure PAM
### 5.4.1 Ensure password creation requirements are configured (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5533
### 5.4.2 Ensure lockout for failed password attempts is
### configured (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5534
### 5.4.3 Ensure password reuse is limited (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5535
### 5.4.4 Ensure password hashing algorithm is SHA-512 (Scored)
-
+ - set_password_hashing_algorithm_systemauth
## 5.5 User Accounts and Environment
### 5.5.1 Set Shadow Password Suite Parameters
#### 5.5.1 Ensure password expiration is 365 days or less (Scored)
-
+ - var_accounts_maximum_age_login_defs=365
+ - accounts_maximum_age_login_defs
#### 5.5.1.2 Ensure minimum days between password changes is 7
#### or more (Scored)
-
+ - var_accounts_minimum_age_login_defs=7
+ - accounts_minimum_age_login_defs
#### 5.5.1.3 Ensure password expiration warning days is
#### 7 or more (Scored)
-
+ - var_accounts_password_warn_age_login_defs=7
+ - accounts_password_warn_age_login_defs
#### 5.5.1.4 Ensure inactive password lock is 30 days or less (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5536
#### 5.5.1.5 Ensure all users last password change date is
#### in the past (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5537
### 5.5.2 Ensure system accounts are secured (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5538
### 5.5.3 Ensure default user shell timeout is 900 seconds
### or less (Scored)
-
+ - var_accounts_tmout=15_min
+ - accounts_tmout
### 5.5.4 Ensure default group for the root account is
### GID 0 (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5539
### 5.5.5 Ensure default user mask is 027 or more restrictive (Scored)
-
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5540
## 5.6 Ensure root login is restricted to system console (Not Scored)
-
+ - securetty_root_login_console_only
+ - no_direct_root_logins
## 5.7 Ensure access to the su command is restricted (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5541
# System Maintenance
@@ -971,8 +978,58 @@ selections:
### 6.2.2 Ensure no legacy "+" entries exist in /etc/passwd (Scored)
- no_legacy_plus_entries_etc_passwd
- ## 6.2.4 Ensure no legacy "+" entries exist in /etc/shadow (Scored)
+ ### 6.2.4 Ensure no legacy "+" entries exist in /etc/shadow (Scored)
- no_legacy_plus_entries_etc_shadow
- ###6.2.5 Ensure no legacy "+" entries exist in /etc/group (Scored)
+ ### 6.2.5 Ensure no legacy "+" entries exist in /etc/group (Scored)
- no_legacy_plus_entries_etc_group
+
+ ### 6.2.6 Ensure root is the only UID 0 account (Scored)
+ - accounts_no_uid_except_zero
+
+ ### 6.2.7 Ensure users' home directories permissions are 750
+ ### or more restrictive (Scored)
+ - file_permissions_home_dirs
+
+ ### 6.2.8 Ensure users own their home directories (Scored)
+ # NEEDS RULE for user owner @ https://github.com/ComplianceAsCode/content/issues/5507
+ - file_groupownership_home_directories
+
+ ### 6.2.9 Ensure users' dot files are not group or world
+ ### writable (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5506
+
+ ### 6.2.10 Ensure no users have .forward files (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5505
+
+ ### 6.2.11 Ensure no users have .netrc files (Scored)
+ - no_netrc_files
+
+ ### 6.2.12 Ensure users' .netrc Files are not group or
+ ### world accessible (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5504
+
+ ### 6.2.13 Ensure no users have .rhosts files (Scored)
+ - no_rsh_trust_files
+
+ ### 6.2.14 Ensure all groups in /etc/passwd exist in
+ ### /etc/group (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5503
+
+ ### 6.2.15 Ensure no duplicate UIDs exist (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5502
+
+ ### 6.2.16 Ensure no duplicate GIDs exist (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5501
+
+ ### 6.2.17 Ensure no duplicate user names exist (Scored)
+ - account_unique_name
+
+ ### 6.2.18 Ensure no duplicate group names exist (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5500
+
+ ### 6.2.19 Ensure shadow group is empty (Scored)
+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5499
+
+ ### 6.2.20 Ensure all users' home directories exist (Scored)
+ - accounts_user_interactive_home_directory_exists
diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt
index feb31b0395..9e7bd35178 100644
--- a/shared/references/cce-redhat-avail.txt
+++ b/shared/references/cce-redhat-avail.txt
@@ -901,8 +901,6 @@ CCE-84270-8
CCE-84271-6
CCE-84272-4
CCE-84273-2
-CCE-84274-0
-CCE-84275-7
CCE-84276-5
CCE-84277-3
CCE-84278-1
From c8a19c84dad5165ece50f6148646f9bbc8c4c3fd Mon Sep 17 00:00:00 2001
From: Shawn Wells <shawn@shawndwells.io>
Date: Sat, 25 Apr 2020 18:52:21 -0400
Subject: [PATCH 02/20] misc cis8 updates
---
.../accounts_users_home_files_ownership/rule.yml | 1 +
.../logging/log_rotation/ensure_logrotate_activated/rule.yml | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml
index a9c73e46ac..8e225cdc64 100644
--- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml
@@ -24,6 +24,7 @@ references:
stigid@ol7: "020660"
disa: "366"
srg: SRG-OS-000480-GPOS-00227
+ cis@rhel8: 6.2.8
stigid@rhel7: "020660"
ocil_clause: 'the user ownership is incorrect'
diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml
index 2c41a3b9ef..6e569edfa9 100644
--- a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml
+++ b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml
@@ -35,7 +35,7 @@ references:
cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01
iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1
cis-csc: 1,14,15,16,3,5,6
- cis@rhel8: 4.3
+ cis@rhel8: "4.3"
anssi: NT28(R43),NT12(R18)
ocil_clause: 'logrotate is not configured to run daily'
From f8d80a55f0cd6bf3b9bf5b75ba037466b7fc89c8 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 22:32:44 +0200
Subject: [PATCH 03/20] Add auxiliary rule for dconf settings
---
rhel8/profiles/cis.profile | 2 ++
1 file changed, 2 insertions(+)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 528f17d696..202db7f693 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -8,6 +8,8 @@ description: |-
09-30-2019.
selections:
+ # Necessary for dconf rules
+ - dconf_db_up_to_date
### Partitioning
- mount_option_home_nodev
From 865fe310e82a1eb0fc0c37c8de253dc7171abae7 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 22:43:20 +0200
Subject: [PATCH 04/20] Update time synchonization rule selections
In RHEL8, only chrony is available
---
rhel8/profiles/cis.profile | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 202db7f693..762d4a04e3 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -256,10 +256,12 @@ selections:
### 2.2.1 Time Synchronization
#### 2.2.1.1 Ensure time synchronization is in use (Not Scored)
- - service_chronyd_or_ntpd_enabled
+ - package_chrony_installed
#### 2.2.1.2 Ensure chrony is configured (Scored)
- - chronyd_or_ntpd_specify_remote_server
+ - service_chronyd_enabled
+ - chronyd_specify_remote_server
+ - chronyd_run_as_chrony_user
### 2.2.2 Ensure X Window System is not installed (Scored)
- package_xorg-x11-server-common_removed
From a515b26c5af850dbc7917807397668df8a076249 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 22:49:55 +0200
Subject: [PATCH 05/20] Select sysctl rules for secure ICMp redirects
Fixes: #5234
Fixes: #5235
---
rhel8/profiles/cis.profile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 762d4a04e3..3a8e19259b 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -371,14 +371,14 @@ selections:
- sysctl_net_ipv6_conf_all_accept_redirects
#### net.ipv6.conf.defaults.accept_redirects = 0
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5234
+ - sysctl_net_ipv6_conf_default_accept_redirects
### 3.2.3 Ensure secure ICMP redirects are not accepted (Scored)
#### net.ipv4.conf.all.secure_redirects = 0
- sysctl_net_ipv4_conf_all_secure_redirects
#### net.ipv4.cof.default.secure_redirects = 0
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5235
+ - sysctl_net_ipv4_conf_default_secure_redirects
### 3.2.4 Ensure suspicious packets are logged (Scored)
#### net.ipv4.conf.all.log_martians = 1
From d14ce8e0ab8c39282883520bb141919af379d0fa Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:02:09 +0200
Subject: [PATCH 06/20] Select Audit DAC rules for RHEL8 CIS
Fixes: #5509
---
rhel8/profiles/cis.profile | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 3a8e19259b..a990de4565 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -606,7 +606,19 @@ selections:
### 4.1.9 Ensure discretionary access control permission modification
### events are collected (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5509
+ - audit_rules_dac_modification_chmod
+ - audit_rules_dac_modification_fchmod
+ - audit_rules_dac_modification_fchmodat
+ - audit_rules_dac_modification_chown
+ - audit_rules_dac_modification_fchown
+ - audit_rules_dac_modification_fchownat
+ - audit_rules_dac_modification_lchown
+ - audit_rules_dac_modification_setxattr
+ - audit_rules_dac_modification_lsetxattr
+ - audit_rules_dac_modification_fsetxattr
+ - audit_rules_dac_modification_removexattr
+ - audit_rules_dac_modification_lremovexattr
+ - audit_rules_dac_modification_fremovexattr
### 4.1.10 Ensure unsuccessful unauthorized file access attempts are
### collected (Scored)
From aec372e7bd05b3ed470f188952dbf11a6ae123ad Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:07:34 +0200
Subject: [PATCH 07/20] Select rules for unsuccessful modification
Fixes: #5510
---
rhel8/profiles/cis.profile | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index a990de4565..db54d9ece5 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -622,7 +622,13 @@ selections:
### 4.1.10 Ensure unsuccessful unauthorized file access attempts are
### collected (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5510
+ - audit_rules_unsuccessful_file_modification_creat
+ - audit_rules_unsuccessful_file_modification_open
+ - audit_rules_unsuccessful_file_modification_openat
+ - audit_rules_unsuccessful_file_modification_truncate
+ - audit_rules_unsuccessful_file_modification_ftruncate
+ # Opinionated selection
+ - audit_rules_unsuccessful_file_modification_open_by_handle_at
### 4.1.11 Ensure events that modify user/group information are
### collected (Scored)
From 69493775c8a5b140f55802f7dca84c659662039c Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:10:45 +0200
Subject: [PATCH 08/20] Select rules for user/group modification
Fixes: #5511
---
rhel8/profiles/cis.profile | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index db54d9ece5..f8ec16b9a8 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -632,7 +632,11 @@ selections:
### 4.1.11 Ensure events that modify user/group information are
### collected (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5511
+ - audit_rules_usergroup_modification_passwd
+ - audit_rules_usergroup_modification_group
+ - audit_rules_usergroup_modification_gshadow
+ - audit_rules_usergroup_modification_shadow
+ - audit_rules_usergroup_modification_opasswd
### 4.1.12 Ensure successful file system mounts are collected (Scored)
# NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5512
From 86c35876312882a861d253e13d31ff5bfc32630b Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:12:58 +0200
Subject: [PATCH 09/20] Audit successful system mounts
Fixes: #5512
---
rhel8/profiles/cis.profile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index f8ec16b9a8..e4f5313e3e 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -639,7 +639,7 @@ selections:
- audit_rules_usergroup_modification_opasswd
### 4.1.12 Ensure successful file system mounts are collected (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5512
+ - audit_rules_media_export
### 4.1.13 Ensure use of privileged commands is collected (Scored)
# NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5513
From ea7ef606c881fdddecfef036383fbd0718950162 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:14:21 +0200
Subject: [PATCH 10/20] Audit privileged commands
Fixes: #5513
---
rhel8/profiles/cis.profile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index e4f5313e3e..087dd79bb5 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -642,7 +642,7 @@ selections:
- audit_rules_media_export
### 4.1.13 Ensure use of privileged commands is collected (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5513
+ - audit_rules_privileged_commands
### 4.1.14 Ensure file deletion events by users are collected
### (Scored)
From 16d84540566c8fa6d9f6880f3f1fe04edf97b822 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:15:49 +0200
Subject: [PATCH 11/20] Audit file deletion events
Fixes: #5514
---
rhel8/profiles/cis.profile | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 087dd79bb5..ca42f24190 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -646,7 +646,12 @@ selections:
### 4.1.14 Ensure file deletion events by users are collected
### (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5514
+ - audit_rules_file_deletion_events_unlink
+ - audit_rules_file_deletion_events_unlinkat
+ - audit_rules_file_deletion_events_rename
+ - audit_rules_file_deletion_events_renameat
+ # Opinionated selection
+ - audit_rules_file_deletion_events_rmdir
### 4.1.15 Ensure kernel module loading and unloading is collected
### (Scored)
From 8377e1d574a9d0388c0847177f11afe83af3a30f Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:16:33 +0200
Subject: [PATCH 12/20] Audit kernel module loads
Fixes: #5515
---
rhel8/profiles/cis.profile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index ca42f24190..5e214941ec 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -655,7 +655,7 @@ selections:
### 4.1.15 Ensure kernel module loading and unloading is collected
### (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5515
+ - audit_rules_kernel_module_loading
### 4.1.16 Ensure system administrator actions (sudolog) are
### collected (Scored)
From 7d62c009987be550d074f8e7cacd2e843d1e3061 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:17:52 +0200
Subject: [PATCH 13/20] Audit rules should be immutable
Fixes: #5517
---
rhel8/profiles/cis.profile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 5e214941ec..a0fdd69869 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -662,7 +662,7 @@ selections:
# NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5516
### 4.1.17 Ensure the audit configuration is immutable (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5517
+ - audit_rules_immutable
## 4.2 Configure Logging
From 02e2a9744bd9eb969b46b18d4824fae65d5764f3 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:31:10 +0200
Subject: [PATCH 14/20] Select rules for password requirements
Related to: #5533
---
rhel8/profiles/cis.profile | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index a0fdd69869..a55c3291a9 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -858,7 +858,12 @@ selections:
## 5.4 Configure PAM
### 5.4.1 Ensure password creation requirements are configured (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5533
+ # NEEDS RULE: try_first_pass - https://github.com/ComplianceAsCode/content/issues/5533
+ - accounts_password_pam_retry
+ - var_password_pam_minlen=14
+ - accounts_password_pam_minlen
+ - var_password_pam_minclass=4
+ - accounts_password_pam_minclass
### 5.4.2 Ensure lockout for failed password attempts is
### configured (Scored)
From bec97effc13e0056cbcdc939620e78669558f9a4 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:35:50 +0200
Subject: [PATCH 15/20] Configure password lockout
Fixes: #5534
---
rhel8/profiles/cis.profile | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index a55c3291a9..6e10c2efcb 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -867,7 +867,10 @@ selections:
### 5.4.2 Ensure lockout for failed password attempts is
### configured (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5534
+ - var_accounts_passwords_pam_faillock_unlock_time=900
+ - var_accounts_passwords_pam_faillock_deny=5
+ - accounts_passwords_pam_faillock_unlock_time
+ - accounts_passwords_pam_faillock_deny
### 5.4.3 Ensure password reuse is limited (Scored)
# NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5535
From 73a087ed0b13bb73f1e60792c4d2e3c3aa944cd9 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:38:58 +0200
Subject: [PATCH 16/20] Configure password reuse
Fixes: #5535
---
rhel8/profiles/cis.profile | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 6e10c2efcb..2fa85d8676 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -873,7 +873,8 @@ selections:
- accounts_passwords_pam_faillock_deny
### 5.4.3 Ensure password reuse is limited (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5535
+ - var_password_pam_unix_remember=5
+ - accounts_password_pam_unix_remember
### 5.4.4 Ensure password hashing algorithm is SHA-512 (Scored)
- set_password_hashing_algorithm_systemauth
From 4307123e1889359b1c444d55a9b221bc5b3f7970 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:43:04 +0200
Subject: [PATCH 17/20] Select rule to check useradd INACTIVE setting
Related to: #5536
---
rhel8/profiles/cis.profile | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 2fa85d8676..e0fd5e1492 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -898,7 +898,10 @@ selections:
- accounts_password_warn_age_login_defs
#### 5.5.1.4 Ensure inactive password lock is 30 days or less (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5536
+ # TODO: Rule doesn't check list of users
+ # https://github.com/ComplianceAsCode/content/issues/5536
+ - var_account_disable_post_pw_expiration=30
+ - account_disable_post_pw_expiration
#### 5.5.1.5 Ensure all users last password change date is
#### in the past (Scored)
From 07752fbac033400946c29fe6cbfe553913e4a96c Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:46:48 +0200
Subject: [PATCH 18/20] No shelllogin for system accounts
Fixes: #5538
---
rhel8/profiles/cis.profile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index e0fd5e1492..0431fb0d45 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -908,7 +908,7 @@ selections:
# NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5537
### 5.5.2 Ensure system accounts are secured (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5538
+ - no_shelllogin_for_systemaccounts
### 5.5.3 Ensure default user shell timeout is 900 seconds
### or less (Scored)
From e46c2cfb8541f559b234df9a8a478494db46e785 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 23:54:07 +0200
Subject: [PATCH 19/20] Partially cover umask requirements
Related to: #5540
---
rhel8/profiles/cis.profile | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile
index 0431fb0d45..f332ee5462 100644
--- a/rhel8/profiles/cis.profile
+++ b/rhel8/profiles/cis.profile
@@ -920,7 +920,9 @@ selections:
# NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5539
### 5.5.5 Ensure default user mask is 027 or more restrictive (Scored)
- # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5540
+ - var_accounts_user_umask=027
+ - accounts_umask_etc_bashrc
+ - accounts_umask_etc_profile
## 5.6 Ensure root login is restricted to system console (Not Scored)
- securetty_root_login_console_only
From 586cedfb95523acbe0c0c92953851d6536c29230 Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Tue, 19 May 2020 22:31:16 +0200
Subject: [PATCH 20/20] account_unique_name: Improve description, rationale and
OCIL
---
.../account_unique_name/rule.yml | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
index 35652a410b..909f1b6657 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
@@ -3,14 +3,13 @@ documentation_complete: true
title: 'Ensure All Accounts on the System Have Unique Names'
description: |-
- Although the <tt>useradd</tt> utility prevents creation of duplicate user
- names, it is possible for a malicious administrator to manually edit the
- <tt>/etc/passwd</tt> file and change the user name.
+ Ensure accounts on the system have unique names.
-rationale: |-
- If a user is assigned a duplicate user name, the new user will be able to
- create and have access to files with the first UID for that username as
- defined in <tt>/etc/passwd</tt>.
+ To ensure all accounts have unique names, run the following command:
+ <pre>$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d</pre>
+ If a username is returned, change or delete the username.
+
+rationale: 'Unique usernames allow for accountability on the system.'
severity: medium
@@ -30,6 +29,6 @@ references:
ocil_clause: 'a line is returned'
ocil: |-
- Run the following command to check for duplicate account names:
- <pre>$ sudo pwck -qr</pre>
- If there are no duplicate names, no line will be returned.
+ To verify all accounts have unique names, run the following command:
+ <pre>$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d</pre>
+ No output should be returned.