From 29eb0f64454f275085015b481a59184e73ebe7f6 Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sun, 29 Mar 2020 00:58:02 -0400 Subject: [PATCH 01/20] update CIS RHEL8 profile --- .../service_crond_enabled/rule.yml | 2 +- .../r_services/no_rsh_trust_files/rule.yml | 8 +- .../rule.yml | 2 +- .../account_unique_name/rule.yml | 11 +- .../accounts_maximum_age_login_defs/rule.yml | 2 +- .../accounts_minimum_age_login_defs/rule.yml | 1 + .../rule.yml | 1 + .../var_accounts_maximum_age_login_defs.var | 1 + .../password_storage/no_netrc_files/rule.yml | 4 +- .../accounts_no_uid_except_zero/rule.yml | 2 +- .../no_direct_root_logins/rule.yml | 2 +- .../rule.yml | 1 + .../accounts-session/accounts_tmout/rule.yml | 1 + .../rule.yml | 1 + .../rule.yml | 1 + .../file_permissions_home_dirs/rule.yml | 4 +- .../rsyslog_files_permissions/rule.yml | 2 +- .../ensure_logrotate_activated/rule.yml | 1 + .../package_rsyslog_installed/rule.yml | 2 +- .../rsyslog_nolisten/rule.yml | 2 + .../rsyslog_remote_loghost/rule.yml | 4 +- .../logging/service_rsyslog_enabled/rule.yml | 2 +- rhel8/profiles/cis.profile | 141 ++++++++++++------ shared/references/cce-redhat-avail.txt | 2 - 24 files changed, 137 insertions(+), 63 deletions(-) diff --git a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml index a1f82cf5c9..09d1a92a55 100644 --- a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml +++ b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml @@ -24,7 +24,7 @@ identifiers: references: stigid@rhel6: "000224" srg@rhel6: SRG-OS-999999 - cis: 5.1.1 + cis@rhel8: 5.1.1 hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii) nist: CM-6(a) nist-csf: PR.IP-1,PR.PT-3 diff --git a/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml b/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml index 2ccf4127b7..ec2fa6c012 100644 --- a/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/rule.yml @@ -12,9 +12,9 @@ description: |- 
$ rm ~/.rhosts
rationale: |- - Trust files are convenient, but when - used in conjunction with the R-services, they can allow - unauthenticated access to a system. + This action is only meaningful if .rhosts support is permitted + through PAM. Trust files are convenient, but when used in conjunction with + the R-services, they can allow unauthenticated access to a system. severity: high @@ -26,7 +26,7 @@ identifiers: references: stigid@rhel6: "000019" srg@rhel6: SRG-OS-000248 - cis: 6.2.14 + cis@rhel8: 6.2.13 disa: "1436" hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii) nist: CM-7(a),CM-7(b),CM-6(a) diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml index fff30d70c7..7a1538392a 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml @@ -43,7 +43,7 @@ references: stigid@rhel6: "000062" srg@rhel6: SRG-OS-000120 disa@rhel6: '803' - cis: 6.3.1 + cis@rhel8: 5.4.4 cjis: 5.6.2.2 cui: 3.13.11 disa: "196" diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml index 2cdafc0609..35652a410b 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml @@ -2,9 +2,15 @@ documentation_complete: true title: 'Ensure All Accounts on the System Have Unique Names' -description: 'Change usernames, or delete accounts, so each has a unique name.' +description: |- + Although the useradd utility prevents creation of duplicate user + names, it is possible for a malicious administrator to manually edit the + /etc/passwd file and change the user name. -rationale: 'Unique usernames allow for accountability on the system.' +rationale: |- + If a user is assigned a duplicate user name, the new user will be able to + create and have access to files with the first UID for that username as + defined in /etc/passwd. severity: medium @@ -19,6 +25,7 @@ references: cjis: 5.5.2 disa: 770,804 pcidss: Req-8.1.1 + cis@rhel8: 6.2.17 ocil_clause: 'a line is returned' diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml index af1ea13d8f..c2c4aa11bc 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml @@ -34,7 +34,7 @@ references: stigid@rhel6: "000053" srg@rhel6: SRG-OS-000076 disa@rhel6: '180' - cis: 5.4.1.1 + cis@rhel8: 5.5.1.1 cjis: 5.6.2.1 cui: 3.5.6 disa: "199" diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml index 2de12efb3e..6147d672a4 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml @@ -44,6 +44,7 @@ references: cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 cis-csc: 1,12,15,16,5 + cis@rhel8: 5.5.1.2 ocil_clause: 'it is not equal to or greater than the required value' diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml index 3a5c00708d..2a1005bd20 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/rule.yml @@ -33,6 +33,7 @@ references: cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 iso27001-2013: A.12.4.1,A.12.4.3,A.18.1.4,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 cis-csc: 1,12,13,14,15,16,18,3,5,7,8 + cis@rhel8: 5.5.1.3 ocil_clause: 'it is not set to the required value' diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var index 731f8f475f..11eb238c5d 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/var_accounts_maximum_age_login_defs.var @@ -9,6 +9,7 @@ type: number interactive: false options: + 365: 365 120: 120 180: 180 60: 60 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml index 01454a7274..8547893201 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_netrc_files/rule.yml @@ -11,8 +11,7 @@ description: |- rationale: |- Unencrypted passwords for remote FTP servers may be stored in .netrc - files. DoD policy requires passwords be encrypted in storage and not used - in access scripts. + files. severity: medium @@ -24,6 +23,7 @@ identifiers: references: stigid@rhel6: "000347" srg@rhel6: SRG-OS-000073 + cis@rhel8: 6.2.11 disa: "196" nist: IA-5(h),IA-5(1)(c),CM-6(a),IA-5(7) nist-csf: PR.AC-1,PR.AC-4,PR.AC-6,PR.AC-7,PR.PT-3 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml index 0b61daf925..14f9140687 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml @@ -31,7 +31,7 @@ references: stigid@ol7: "020310" stigid@rhel6: "000032" srg@rhel6: SRG-OS-999999 - cis: 6.2.5 + cis@rhel8: 6.2.6 cui: 3.1.1,3.1.5 disa: "366" nist: IA-2,AC-6(5),IA-4(b) diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml index 1d08bde4d9..9e00f3aad6 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/rule.yml @@ -33,7 +33,7 @@ identifiers: cce@ocp4: 82698-2 references: - cis: "5.5" + cis@rhel8: "5.6" cui: 3.1.1,3.1.6 hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii) nist: IA-2,CM-6(a) diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml index ae8ba133b7..0c26ac3240 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/securetty_root_login_console_only/rule.yml @@ -35,6 +35,7 @@ references: cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 cis-csc: 12,13,14,15,16,18,3,5 + cis@rhel8: "5.6" srg: SRG-OS-000324-GPOS-00125 ocil_clause: 'root login over virtual console devices is permitted' diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml index 787f2264de..f09006b72b 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml @@ -38,6 +38,7 @@ references: cobit5: DSS05.04,DSS05.10,DSS06.10 iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 cis-csc: 1,12,15,16 + cis@rhel8: 5.5.3 anssi: NT28(R29) ocil_clause: 'value of TMOUT is not less than or equal to expected setting' diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml index e7e9a751a4..bedf3a0b19 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml @@ -27,6 +27,7 @@ references: disa: "366" srg: SRG-OS-000480-GPOS-00227 stigid@rhel7: "020620" + cis@rhel8: 6.2.20 ocil_clause: 'users home directory does not exist' diff --git a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml index d58884235e..1c5ac8d099 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml @@ -26,6 +26,7 @@ references: disa: "366" srg: SRG-OS-000480-GPOS-00227 stigid@rhel7: "020650" + cis@rhel8: 6.2.8 ocil_clause: 'the group ownership is incorrect' diff --git a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml index 8812f9d123..27c190b5b1 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_dirs/rule.yml @@ -22,11 +22,12 @@ rationale: |- to one another's home directories, this can be provided using groups or ACLs. -severity: unknown +severity: medium identifiers: cce@rhel6: 26981-1 cce@rhel7: 80201-7 + cce@rhel8: 84274-0 references: disa: "225" @@ -37,6 +38,7 @@ references: cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 cis-csc: 12,13,14,15,16,18,3,5 + cis@rhel8: 6.2.7 ocil_clause: 'the user home directory is group-writable or world-readable' diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml index 4c1e69020b..aa6e0905ae 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_permissions/rule.yml @@ -31,7 +31,7 @@ references: anssi: NT28(R36) stigid@rhel6: "000135" srg@rhel6: SRG-OS-000206 - cis: 4.2.1.3 + cis@rhel8: 4.2.1.3 disa: "1314" nist: CM-6(a),AC-6(1) pcidss: Req-10.5.1,Req-10.5.2 diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml index def9566692..2c41a3b9ef 100644 --- a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml +++ b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml @@ -35,6 +35,7 @@ references: cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01 iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1 cis-csc: 1,14,15,16,3,5,6 + cis@rhel8: 4.3 anssi: NT28(R43),NT12(R18) ocil_clause: 'logrotate is not configured to run daily' diff --git a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml index 9f00dd9704..00fecf8a3c 100644 --- a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml +++ b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml @@ -18,7 +18,7 @@ identifiers: references: cis@debian8: 5.1.1 anssi: NT28(R5),NT28(R46) - cis: 4.2.3 + cis@rhel8: 4.2.1.1 disa: 1311,1312 hipaa: 164.312(a)(2)(ii) iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1 diff --git a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml index 8a5a15e1da..14e729252c 100644 --- a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml +++ b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml @@ -26,6 +26,7 @@ severity: medium identifiers: cce@rhel6: 26803-7 cce@rhel7: 80192-8 + cce@rhel8: 84275-7 references: stigid@ol7: "031010" @@ -39,3 +40,4 @@ references: iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.5.1,A.12.6.2,A.12.7.1,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 cis-csc: 1,11,12,13,14,15,16,18,3,4,5,6,8,9 stigid@rhel7: "031010" + cis@rhel8: 4.2.1.6 diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml index 7b70b0c186..da28b99561 100644 --- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml +++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml @@ -46,8 +46,8 @@ references: anssi: NT28(R7),NT28(R43),NT12(R5) stigid@rhel6: "000136" srg@rhel6: SRG-OS-000043,SRG-OS-000215 - cis: 4.2.1.4 - disa: 136,366,1348,1851 + cis@rhel8: 4.2.1.5 + disa: 366,1348,136,1851 hipaa: 164.308(a)(1)(ii)(D),164.308(a)(5)(ii)(B),164.308(a)(5)(ii)(C),164.308(a)(6)(ii),164.308(a)(8),164.310(d)(2)(iii),164.312(b),164.314(a)(2)(i)(C),164.314(a)(2)(iii) iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.17.2.1 nist: CM-6(a),AU-4(1),AU-9(2) diff --git a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml index ce8347c686..92fd6bc4d8 100644 --- a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml +++ b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml @@ -20,7 +20,7 @@ identifiers: references: cis@debian8: 5.1.2 anssi: NT28(R5),NT28(R46) - cis: 4.2.1.1 + cis@rhel8: 4.2.1.2 disa: 1311,1312,1557,1851 hipaa: 164.312(a)(2)(ii) iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.14.2.7,A.15.2.1,A.15.2.2,A.17.2.1 diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index cc0c2a5b9a..528f17d696 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -602,87 +602,88 @@ selections: ### 4.1.9 Ensure discretionary access control permission modification ### events are collected (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5509 ### 4.1.10 Ensure unsuccessful unauthorized file access attempts are ### collected (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5510 ### 4.1.11 Ensure events that modify user/group information are ### collected (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5511 ### 4.1.12 Ensure successful file system mounts are collected (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5512 ### 4.1.13 Ensure use of privileged commands is collected (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5513 ### 4.1.14 Ensure file deletion events by users are collected ### (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5514 ### 4.1.15 Ensure kernel module loading and unloading is collected ### (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5515 ### 4.1.16 Ensure system administrator actions (sudolog) are ### collected (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5516 ### 4.1.17 Ensure the audit configuration is immutable (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5517 ## 4.2 Configure Logging ### 4.2.1 Configure rsyslog #### 4.2.1.1 Ensure rsyslog is installed (Scored) - + - package_rsyslog_installed #### 4.2.1.2 Ensure rsyslog Service is enabled (Scored) - + - service_rsyslog_enabled #### 4.2.1.3 Ensure rsyslog default file permissions configured (Scored) - + - rsyslog_files_permissions #### 4.2.1.4 Ensure logging is configured (Not Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5519 #### 4.2.1.5 Ensure rsyslog is configured to send logs to a remote #### log host (Scored) - + - rsyslog_remote_loghost #### 4.2.1.6 Ensure remote rsyslog messages are only accepted on #### designated log hosts (Not Scored) - + - rsyslog_nolisten ### 4.2.2 Configure journald #### 4.2.2.1 Ensure journald is configured to send logs to #### rsyslog (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5520 #### 4.2.2.2 Ensure journald is configured to compress large #### log files (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5521 #### 4.2.2.3 Ensure journald is configured to write logfiles to #### persistent disk (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5522 ### 4.2.3 Ensure permissions on all logfiles are configured (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5523 ## 4.3 Ensure logrotate is conifgured (Not Scored) - + - ensure_logrotate_activated # 5 Access, Authentication and Authorization ## 5.1 Configure cron - ### 5.1.1 Ensure cron daemon is enabled (Scored) + - service_crond_enabled ### 5.1.2 Ensure permissions on /etc/crontab are configured (Scored) @@ -790,19 +791,19 @@ selections: ### 5.2.14 Ensure SSH LoginGraceTime is set to one minute ### or less (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5525 ### 5.2.15 Ensure SSH warning banner is configured (Scored) - sshd_enable_warning_banner ### 5.2.16 Ensure SSH PAM is enabled (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5526 ### 5.2.17 Ensure SSH AllowTcpForwarding is disabled (Scored) - sshd_disable_tcp_forwarding ### 5.2.18 Ensure SSH MaxStarups is configured (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5528 ### 5.2.19 Ensure SSH MaxSessions is set to 4 or less (Scored) - sshd_set_max_sessions @@ -815,69 +816,75 @@ selections: ### 5.3.1 Create custom authselectet profile (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5530 ### 5.3.2 Select authselect profile (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5531 ### 5.3.3 Ensure authselect includes with-faillock (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5532 ## 5.4 Configure PAM ### 5.4.1 Ensure password creation requirements are configured (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5533 ### 5.4.2 Ensure lockout for failed password attempts is ### configured (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5534 ### 5.4.3 Ensure password reuse is limited (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5535 ### 5.4.4 Ensure password hashing algorithm is SHA-512 (Scored) - + - set_password_hashing_algorithm_systemauth ## 5.5 User Accounts and Environment ### 5.5.1 Set Shadow Password Suite Parameters #### 5.5.1 Ensure password expiration is 365 days or less (Scored) - + - var_accounts_maximum_age_login_defs=365 + - accounts_maximum_age_login_defs #### 5.5.1.2 Ensure minimum days between password changes is 7 #### or more (Scored) - + - var_accounts_minimum_age_login_defs=7 + - accounts_minimum_age_login_defs #### 5.5.1.3 Ensure password expiration warning days is #### 7 or more (Scored) - + - var_accounts_password_warn_age_login_defs=7 + - accounts_password_warn_age_login_defs #### 5.5.1.4 Ensure inactive password lock is 30 days or less (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5536 #### 5.5.1.5 Ensure all users last password change date is #### in the past (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5537 ### 5.5.2 Ensure system accounts are secured (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5538 ### 5.5.3 Ensure default user shell timeout is 900 seconds ### or less (Scored) - + - var_accounts_tmout=15_min + - accounts_tmout ### 5.5.4 Ensure default group for the root account is ### GID 0 (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5539 ### 5.5.5 Ensure default user mask is 027 or more restrictive (Scored) - + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5540 ## 5.6 Ensure root login is restricted to system console (Not Scored) - + - securetty_root_login_console_only + - no_direct_root_logins ## 5.7 Ensure access to the su command is restricted (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5541 # System Maintenance @@ -971,8 +978,58 @@ selections: ### 6.2.2 Ensure no legacy "+" entries exist in /etc/passwd (Scored) - no_legacy_plus_entries_etc_passwd - ## 6.2.4 Ensure no legacy "+" entries exist in /etc/shadow (Scored) + ### 6.2.4 Ensure no legacy "+" entries exist in /etc/shadow (Scored) - no_legacy_plus_entries_etc_shadow - ###6.2.5 Ensure no legacy "+" entries exist in /etc/group (Scored) + ### 6.2.5 Ensure no legacy "+" entries exist in /etc/group (Scored) - no_legacy_plus_entries_etc_group + + ### 6.2.6 Ensure root is the only UID 0 account (Scored) + - accounts_no_uid_except_zero + + ### 6.2.7 Ensure users' home directories permissions are 750 + ### or more restrictive (Scored) + - file_permissions_home_dirs + + ### 6.2.8 Ensure users own their home directories (Scored) + # NEEDS RULE for user owner @ https://github.com/ComplianceAsCode/content/issues/5507 + - file_groupownership_home_directories + + ### 6.2.9 Ensure users' dot files are not group or world + ### writable (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5506 + + ### 6.2.10 Ensure no users have .forward files (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5505 + + ### 6.2.11 Ensure no users have .netrc files (Scored) + - no_netrc_files + + ### 6.2.12 Ensure users' .netrc Files are not group or + ### world accessible (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5504 + + ### 6.2.13 Ensure no users have .rhosts files (Scored) + - no_rsh_trust_files + + ### 6.2.14 Ensure all groups in /etc/passwd exist in + ### /etc/group (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5503 + + ### 6.2.15 Ensure no duplicate UIDs exist (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5502 + + ### 6.2.16 Ensure no duplicate GIDs exist (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5501 + + ### 6.2.17 Ensure no duplicate user names exist (Scored) + - account_unique_name + + ### 6.2.18 Ensure no duplicate group names exist (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5500 + + ### 6.2.19 Ensure shadow group is empty (Scored) + # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5499 + + ### 6.2.20 Ensure all users' home directories exist (Scored) + - accounts_user_interactive_home_directory_exists diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index feb31b0395..9e7bd35178 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -901,8 +901,6 @@ CCE-84270-8 CCE-84271-6 CCE-84272-4 CCE-84273-2 -CCE-84274-0 -CCE-84275-7 CCE-84276-5 CCE-84277-3 CCE-84278-1 From c8a19c84dad5165ece50f6148646f9bbc8c4c3fd Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Sat, 25 Apr 2020 18:52:21 -0400 Subject: [PATCH 02/20] misc cis8 updates --- .../accounts_users_home_files_ownership/rule.yml | 1 + .../logging/log_rotation/ensure_logrotate_activated/rule.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml index a9c73e46ac..8e225cdc64 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml @@ -24,6 +24,7 @@ references: stigid@ol7: "020660" disa: "366" srg: SRG-OS-000480-GPOS-00227 + cis@rhel8: 6.2.8 stigid@rhel7: "020660" ocil_clause: 'the user ownership is incorrect' diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml index 2c41a3b9ef..6e569edfa9 100644 --- a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml +++ b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/rule.yml @@ -35,7 +35,7 @@ references: cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01 iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1 cis-csc: 1,14,15,16,3,5,6 - cis@rhel8: 4.3 + cis@rhel8: "4.3" anssi: NT28(R43),NT12(R18) ocil_clause: 'logrotate is not configured to run daily' From f8d80a55f0cd6bf3b9bf5b75ba037466b7fc89c8 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 22:32:44 +0200 Subject: [PATCH 03/20] Add auxiliary rule for dconf settings --- rhel8/profiles/cis.profile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 528f17d696..202db7f693 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -8,6 +8,8 @@ description: |- 09-30-2019. selections: + # Necessary for dconf rules + - dconf_db_up_to_date ### Partitioning - mount_option_home_nodev From 865fe310e82a1eb0fc0c37c8de253dc7171abae7 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 22:43:20 +0200 Subject: [PATCH 04/20] Update time synchonization rule selections In RHEL8, only chrony is available --- rhel8/profiles/cis.profile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 202db7f693..762d4a04e3 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -256,10 +256,12 @@ selections: ### 2.2.1 Time Synchronization #### 2.2.1.1 Ensure time synchronization is in use (Not Scored) - - service_chronyd_or_ntpd_enabled + - package_chrony_installed #### 2.2.1.2 Ensure chrony is configured (Scored) - - chronyd_or_ntpd_specify_remote_server + - service_chronyd_enabled + - chronyd_specify_remote_server + - chronyd_run_as_chrony_user ### 2.2.2 Ensure X Window System is not installed (Scored) - package_xorg-x11-server-common_removed From a515b26c5af850dbc7917807397668df8a076249 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 22:49:55 +0200 Subject: [PATCH 05/20] Select sysctl rules for secure ICMp redirects Fixes: #5234 Fixes: #5235 --- rhel8/profiles/cis.profile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 762d4a04e3..3a8e19259b 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -371,14 +371,14 @@ selections: - sysctl_net_ipv6_conf_all_accept_redirects #### net.ipv6.conf.defaults.accept_redirects = 0 - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5234 + - sysctl_net_ipv6_conf_default_accept_redirects ### 3.2.3 Ensure secure ICMP redirects are not accepted (Scored) #### net.ipv4.conf.all.secure_redirects = 0 - sysctl_net_ipv4_conf_all_secure_redirects #### net.ipv4.cof.default.secure_redirects = 0 - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5235 + - sysctl_net_ipv4_conf_default_secure_redirects ### 3.2.4 Ensure suspicious packets are logged (Scored) #### net.ipv4.conf.all.log_martians = 1 From d14ce8e0ab8c39282883520bb141919af379d0fa Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:02:09 +0200 Subject: [PATCH 06/20] Select Audit DAC rules for RHEL8 CIS Fixes: #5509 --- rhel8/profiles/cis.profile | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 3a8e19259b..a990de4565 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -606,7 +606,19 @@ selections: ### 4.1.9 Ensure discretionary access control permission modification ### events are collected (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5509 + - audit_rules_dac_modification_chmod + - audit_rules_dac_modification_fchmod + - audit_rules_dac_modification_fchmodat + - audit_rules_dac_modification_chown + - audit_rules_dac_modification_fchown + - audit_rules_dac_modification_fchownat + - audit_rules_dac_modification_lchown + - audit_rules_dac_modification_setxattr + - audit_rules_dac_modification_lsetxattr + - audit_rules_dac_modification_fsetxattr + - audit_rules_dac_modification_removexattr + - audit_rules_dac_modification_lremovexattr + - audit_rules_dac_modification_fremovexattr ### 4.1.10 Ensure unsuccessful unauthorized file access attempts are ### collected (Scored) From aec372e7bd05b3ed470f188952dbf11a6ae123ad Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:07:34 +0200 Subject: [PATCH 07/20] Select rules for unsuccessful modification Fixes: #5510 --- rhel8/profiles/cis.profile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index a990de4565..db54d9ece5 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -622,7 +622,13 @@ selections: ### 4.1.10 Ensure unsuccessful unauthorized file access attempts are ### collected (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5510 + - audit_rules_unsuccessful_file_modification_creat + - audit_rules_unsuccessful_file_modification_open + - audit_rules_unsuccessful_file_modification_openat + - audit_rules_unsuccessful_file_modification_truncate + - audit_rules_unsuccessful_file_modification_ftruncate + # Opinionated selection + - audit_rules_unsuccessful_file_modification_open_by_handle_at ### 4.1.11 Ensure events that modify user/group information are ### collected (Scored) From 69493775c8a5b140f55802f7dca84c659662039c Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:10:45 +0200 Subject: [PATCH 08/20] Select rules for user/group modification Fixes: #5511 --- rhel8/profiles/cis.profile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index db54d9ece5..f8ec16b9a8 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -632,7 +632,11 @@ selections: ### 4.1.11 Ensure events that modify user/group information are ### collected (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5511 + - audit_rules_usergroup_modification_passwd + - audit_rules_usergroup_modification_group + - audit_rules_usergroup_modification_gshadow + - audit_rules_usergroup_modification_shadow + - audit_rules_usergroup_modification_opasswd ### 4.1.12 Ensure successful file system mounts are collected (Scored) # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5512 From 86c35876312882a861d253e13d31ff5bfc32630b Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:12:58 +0200 Subject: [PATCH 09/20] Audit successful system mounts Fixes: #5512 --- rhel8/profiles/cis.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index f8ec16b9a8..e4f5313e3e 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -639,7 +639,7 @@ selections: - audit_rules_usergroup_modification_opasswd ### 4.1.12 Ensure successful file system mounts are collected (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5512 + - audit_rules_media_export ### 4.1.13 Ensure use of privileged commands is collected (Scored) # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5513 From ea7ef606c881fdddecfef036383fbd0718950162 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:14:21 +0200 Subject: [PATCH 10/20] Audit privileged commands Fixes: #5513 --- rhel8/profiles/cis.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index e4f5313e3e..087dd79bb5 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -642,7 +642,7 @@ selections: - audit_rules_media_export ### 4.1.13 Ensure use of privileged commands is collected (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5513 + - audit_rules_privileged_commands ### 4.1.14 Ensure file deletion events by users are collected ### (Scored) From 16d84540566c8fa6d9f6880f3f1fe04edf97b822 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:15:49 +0200 Subject: [PATCH 11/20] Audit file deletion events Fixes: #5514 --- rhel8/profiles/cis.profile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 087dd79bb5..ca42f24190 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -646,7 +646,12 @@ selections: ### 4.1.14 Ensure file deletion events by users are collected ### (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5514 + - audit_rules_file_deletion_events_unlink + - audit_rules_file_deletion_events_unlinkat + - audit_rules_file_deletion_events_rename + - audit_rules_file_deletion_events_renameat + # Opinionated selection + - audit_rules_file_deletion_events_rmdir ### 4.1.15 Ensure kernel module loading and unloading is collected ### (Scored) From 8377e1d574a9d0388c0847177f11afe83af3a30f Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:16:33 +0200 Subject: [PATCH 12/20] Audit kernel module loads Fixes: #5515 --- rhel8/profiles/cis.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index ca42f24190..5e214941ec 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -655,7 +655,7 @@ selections: ### 4.1.15 Ensure kernel module loading and unloading is collected ### (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5515 + - audit_rules_kernel_module_loading ### 4.1.16 Ensure system administrator actions (sudolog) are ### collected (Scored) From 7d62c009987be550d074f8e7cacd2e843d1e3061 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:17:52 +0200 Subject: [PATCH 13/20] Audit rules should be immutable Fixes: #5517 --- rhel8/profiles/cis.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 5e214941ec..a0fdd69869 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -662,7 +662,7 @@ selections: # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5516 ### 4.1.17 Ensure the audit configuration is immutable (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5517 + - audit_rules_immutable ## 4.2 Configure Logging From 02e2a9744bd9eb969b46b18d4824fae65d5764f3 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:31:10 +0200 Subject: [PATCH 14/20] Select rules for password requirements Related to: #5533 --- rhel8/profiles/cis.profile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index a0fdd69869..a55c3291a9 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -858,7 +858,12 @@ selections: ## 5.4 Configure PAM ### 5.4.1 Ensure password creation requirements are configured (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5533 + # NEEDS RULE: try_first_pass - https://github.com/ComplianceAsCode/content/issues/5533 + - accounts_password_pam_retry + - var_password_pam_minlen=14 + - accounts_password_pam_minlen + - var_password_pam_minclass=4 + - accounts_password_pam_minclass ### 5.4.2 Ensure lockout for failed password attempts is ### configured (Scored) From bec97effc13e0056cbcdc939620e78669558f9a4 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:35:50 +0200 Subject: [PATCH 15/20] Configure password lockout Fixes: #5534 --- rhel8/profiles/cis.profile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index a55c3291a9..6e10c2efcb 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -867,7 +867,10 @@ selections: ### 5.4.2 Ensure lockout for failed password attempts is ### configured (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5534 + - var_accounts_passwords_pam_faillock_unlock_time=900 + - var_accounts_passwords_pam_faillock_deny=5 + - accounts_passwords_pam_faillock_unlock_time + - accounts_passwords_pam_faillock_deny ### 5.4.3 Ensure password reuse is limited (Scored) # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5535 From 73a087ed0b13bb73f1e60792c4d2e3c3aa944cd9 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:38:58 +0200 Subject: [PATCH 16/20] Configure password reuse Fixes: #5535 --- rhel8/profiles/cis.profile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 6e10c2efcb..2fa85d8676 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -873,7 +873,8 @@ selections: - accounts_passwords_pam_faillock_deny ### 5.4.3 Ensure password reuse is limited (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5535 + - var_password_pam_unix_remember=5 + - accounts_password_pam_unix_remember ### 5.4.4 Ensure password hashing algorithm is SHA-512 (Scored) - set_password_hashing_algorithm_systemauth From 4307123e1889359b1c444d55a9b221bc5b3f7970 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:43:04 +0200 Subject: [PATCH 17/20] Select rule to check useradd INACTIVE setting Related to: #5536 --- rhel8/profiles/cis.profile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 2fa85d8676..e0fd5e1492 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -898,7 +898,10 @@ selections: - accounts_password_warn_age_login_defs #### 5.5.1.4 Ensure inactive password lock is 30 days or less (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5536 + # TODO: Rule doesn't check list of users + # https://github.com/ComplianceAsCode/content/issues/5536 + - var_account_disable_post_pw_expiration=30 + - account_disable_post_pw_expiration #### 5.5.1.5 Ensure all users last password change date is #### in the past (Scored) From 07752fbac033400946c29fe6cbfe553913e4a96c Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:46:48 +0200 Subject: [PATCH 18/20] No shelllogin for system accounts Fixes: #5538 --- rhel8/profiles/cis.profile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index e0fd5e1492..0431fb0d45 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -908,7 +908,7 @@ selections: # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5537 ### 5.5.2 Ensure system accounts are secured (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5538 + - no_shelllogin_for_systemaccounts ### 5.5.3 Ensure default user shell timeout is 900 seconds ### or less (Scored) From e46c2cfb8541f559b234df9a8a478494db46e785 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 23:54:07 +0200 Subject: [PATCH 19/20] Partially cover umask requirements Related to: #5540 --- rhel8/profiles/cis.profile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/rhel8/profiles/cis.profile b/rhel8/profiles/cis.profile index 0431fb0d45..f332ee5462 100644 --- a/rhel8/profiles/cis.profile +++ b/rhel8/profiles/cis.profile @@ -920,7 +920,9 @@ selections: # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5539 ### 5.5.5 Ensure default user mask is 027 or more restrictive (Scored) - # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5540 + - var_accounts_user_umask=027 + - accounts_umask_etc_bashrc + - accounts_umask_etc_profile ## 5.6 Ensure root login is restricted to system console (Not Scored) - securetty_root_login_console_only From 586cedfb95523acbe0c0c92953851d6536c29230 Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Tue, 19 May 2020 22:31:16 +0200 Subject: [PATCH 20/20] account_unique_name: Improve description, rationale and OCIL --- .../account_unique_name/rule.yml | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml index 35652a410b..909f1b6657 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml @@ -3,14 +3,13 @@ documentation_complete: true title: 'Ensure All Accounts on the System Have Unique Names' description: |- - Although the useradd utility prevents creation of duplicate user - names, it is possible for a malicious administrator to manually edit the - /etc/passwd file and change the user name. + Ensure accounts on the system have unique names. -rationale: |- - If a user is assigned a duplicate user name, the new user will be able to - create and have access to files with the first UID for that username as - defined in /etc/passwd. + To ensure all accounts have unique names, run the following command: + 
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
+ If a username is returned, change or delete the username. + +rationale: 'Unique usernames allow for accountability on the system.' severity: medium @@ -30,6 +29,6 @@ references: ocil_clause: 'a line is returned' ocil: |- - Run the following command to check for duplicate account names: - 
$ sudo pwck -qr
- If there are no duplicate names, no line will be returned. + To verify all accounts have unique names, run the following command: + 
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
+ No output should be returned.