|
 |
30eaf1 |
From 775dec7b479f9fa900fa46d174b202efc14407fa Mon Sep 17 00:00:00 2001
|
|
|
30eaf1 |
From: Watson Sato <wsato@redhat.com>
|
|
|
30eaf1 |
Date: Mon, 13 Feb 2023 11:14:40 +0100
|
|
|
30eaf1 |
Subject: [PATCH 6/6] remove rule logind_session_timeout and associated
|
|
|
30eaf1 |
variable from profiles
|
|
|
30eaf1 |
|
|
|
30eaf1 |
Patch-name: scap-security-guide-0.1.67-remove_logind_session_timeout_from_profiles-PR_10202.patch
|
|
|
30eaf1 |
Patch-status: remove rule logind_session_timeout and associated variable from profiles
|
|
|
30eaf1 |
---
|
|
|
30eaf1 |
controls/anssi.yml | 2 --
|
|
|
30eaf1 |
products/rhel8/profiles/cjis.profile | 2 --
|
|
|
30eaf1 |
products/rhel8/profiles/ospp.profile | 2 --
|
|
|
30eaf1 |
products/rhel8/profiles/pci-dss.profile | 2 --
|
|
|
30eaf1 |
products/rhel8/profiles/rht-ccp.profile | 2 --
|
|
|
30eaf1 |
tests/data/profile_stability/rhel8/ospp.profile | 2 --
|
|
|
30eaf1 |
tests/data/profile_stability/rhel8/pci-dss.profile | 2 --
|
|
|
30eaf1 |
7 files changed, 14 deletions(-)
|
|
|
30eaf1 |
|
|
|
30eaf1 |
diff --git a/controls/anssi.yml b/controls/anssi.yml
|
|
|
30eaf1 |
index 607ce976ef..9e631d1de4 100644
|
|
|
30eaf1 |
--- a/controls/anssi.yml
|
|
|
30eaf1 |
+++ b/controls/anssi.yml
|
|
|
30eaf1 |
@@ -676,8 +676,6 @@ controls:
|
|
|
30eaf1 |
- var_accounts_tmout=10_min
|
|
|
30eaf1 |
- sshd_set_idle_timeout
|
|
|
30eaf1 |
- sshd_idle_timeout_value=10_minutes
|
|
|
30eaf1 |
- - logind_session_timeout
|
|
|
30eaf1 |
- - var_logind_session_timeout=10_minutes
|
|
|
30eaf1 |
- sshd_set_keepalive
|
|
|
30eaf1 |
|
|
|
30eaf1 |
- id: R30
|
|
|
30eaf1 |
diff --git a/products/rhel8/profiles/cjis.profile b/products/rhel8/profiles/cjis.profile
|
|
|
30eaf1 |
index f60b65bc06..18394802b9 100644
|
|
|
30eaf1 |
--- a/products/rhel8/profiles/cjis.profile
|
|
|
30eaf1 |
+++ b/products/rhel8/profiles/cjis.profile
|
|
|
30eaf1 |
@@ -104,7 +104,6 @@ selections:
|
|
|
30eaf1 |
- sshd_allow_only_protocol2
|
|
|
30eaf1 |
- sshd_set_idle_timeout
|
|
|
30eaf1 |
- var_sshd_set_keepalive=0
|
|
|
30eaf1 |
- - logind_session_timeout
|
|
|
30eaf1 |
- sshd_set_keepalive_0
|
|
|
30eaf1 |
- disable_host_auth
|
|
|
30eaf1 |
- sshd_disable_root_login
|
|
|
30eaf1 |
@@ -120,7 +119,6 @@ selections:
|
|
|
30eaf1 |
- set_firewalld_default_zone
|
|
|
30eaf1 |
- firewalld_sshd_port_enabled
|
|
|
30eaf1 |
- sshd_idle_timeout_value=30_minutes
|
|
|
30eaf1 |
- - var_logind_session_timeout=30_minutes
|
|
|
30eaf1 |
- inactivity_timeout_value=30_minutes
|
|
|
30eaf1 |
- sysctl_net_ipv4_conf_default_accept_source_route
|
|
|
30eaf1 |
- sysctl_net_ipv4_tcp_syncookies
|
|
|
30eaf1 |
diff --git a/products/rhel8/profiles/ospp.profile b/products/rhel8/profiles/ospp.profile
|
|
|
30eaf1 |
index 0fe17b2085..fb46ab4c0c 100644
|
|
|
30eaf1 |
--- a/products/rhel8/profiles/ospp.profile
|
|
|
30eaf1 |
+++ b/products/rhel8/profiles/ospp.profile
|
|
|
30eaf1 |
@@ -300,8 +300,6 @@ selections:
|
|
|
30eaf1 |
## We deliberately set sshd timeout to 1 minute before tmux lock timeout
|
|
|
30eaf1 |
- sshd_idle_timeout_value=14_minutes
|
|
|
30eaf1 |
- sshd_set_idle_timeout
|
|
|
30eaf1 |
- - logind_session_timeout
|
|
|
30eaf1 |
- - var_logind_session_timeout=14_minutes
|
|
|
30eaf1 |
|
|
|
30eaf1 |
## Disable Unauthenticated Login (such as Guest Accounts)
|
|
|
30eaf1 |
## FIA_UAU.1
|
|
|
30eaf1 |
diff --git a/products/rhel8/profiles/pci-dss.profile b/products/rhel8/profiles/pci-dss.profile
|
|
|
30eaf1 |
index c63c5f4a07..c0c9b12773 100644
|
|
|
30eaf1 |
--- a/products/rhel8/profiles/pci-dss.profile
|
|
|
30eaf1 |
+++ b/products/rhel8/profiles/pci-dss.profile
|
|
|
30eaf1 |
@@ -17,7 +17,6 @@ selections:
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_deny=6
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_unlock_time=1800
|
|
|
30eaf1 |
- sshd_idle_timeout_value=15_minutes
|
|
|
30eaf1 |
- - var_logind_session_timeout=15_minutes
|
|
|
30eaf1 |
- var_password_pam_minlen=7
|
|
|
30eaf1 |
- var_password_pam_minclass=2
|
|
|
30eaf1 |
- var_accounts_maximum_age_login_defs=90
|
|
|
30eaf1 |
@@ -110,7 +109,6 @@ selections:
|
|
|
30eaf1 |
- dconf_gnome_screensaver_lock_enabled
|
|
|
30eaf1 |
- dconf_gnome_screensaver_mode_blank
|
|
|
30eaf1 |
- sshd_set_idle_timeout
|
|
|
30eaf1 |
- - logind_session_timeout
|
|
|
30eaf1 |
- var_sshd_set_keepalive=0
|
|
|
30eaf1 |
- sshd_set_keepalive_0
|
|
|
30eaf1 |
- accounts_password_pam_minlen
|
|
|
30eaf1 |
diff --git a/products/rhel8/profiles/rht-ccp.profile b/products/rhel8/profiles/rht-ccp.profile
|
|
|
30eaf1 |
index 0a00d2f46b..775727e885 100644
|
|
|
30eaf1 |
--- a/products/rhel8/profiles/rht-ccp.profile
|
|
|
30eaf1 |
+++ b/products/rhel8/profiles/rht-ccp.profile
|
|
|
30eaf1 |
@@ -12,7 +12,6 @@ selections:
|
|
|
30eaf1 |
- var_selinux_state=enforcing
|
|
|
30eaf1 |
- var_selinux_policy_name=targeted
|
|
|
30eaf1 |
- sshd_idle_timeout_value=5_minutes
|
|
|
30eaf1 |
- - var_logind_session_timeout=5_minutes
|
|
|
30eaf1 |
- var_accounts_minimum_age_login_defs=7
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_deny=5
|
|
|
30eaf1 |
- var_accounts_password_warn_age_login_defs=7
|
|
|
30eaf1 |
@@ -89,7 +88,6 @@ selections:
|
|
|
30eaf1 |
- package_telnet_removed
|
|
|
30eaf1 |
- sshd_allow_only_protocol2
|
|
|
30eaf1 |
- sshd_set_idle_timeout
|
|
|
30eaf1 |
- - logind_session_timeout
|
|
|
30eaf1 |
- var_sshd_set_keepalive=0
|
|
|
30eaf1 |
- sshd_set_keepalive_0
|
|
|
30eaf1 |
- disable_host_auth
|
|
|
30eaf1 |
diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile
|
|
|
30eaf1 |
index a31f3245d8..267b66a4f8 100644
|
|
|
30eaf1 |
--- a/tests/data/profile_stability/rhel8/ospp.profile
|
|
|
30eaf1 |
+++ b/tests/data/profile_stability/rhel8/ospp.profile
|
|
|
30eaf1 |
@@ -104,7 +104,6 @@ selections:
|
|
|
30eaf1 |
- kernel_module_firewire-core_disabled
|
|
|
30eaf1 |
- kernel_module_sctp_disabled
|
|
|
30eaf1 |
- kernel_module_tipc_disabled
|
|
|
30eaf1 |
-- logind_session_timeout
|
|
|
30eaf1 |
- mount_option_boot_nodev
|
|
|
30eaf1 |
- mount_option_boot_nosuid
|
|
|
30eaf1 |
- mount_option_dev_shm_nodev
|
|
|
30eaf1 |
@@ -254,7 +253,6 @@ selections:
|
|
|
30eaf1 |
- var_password_pam_ucredit=1
|
|
|
30eaf1 |
- var_password_pam_lcredit=1
|
|
|
30eaf1 |
- sshd_idle_timeout_value=14_minutes
|
|
|
30eaf1 |
-- var_logind_session_timeout=14_minutes
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_deny=3
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_fail_interval=900
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_unlock_time=never
|
|
|
30eaf1 |
diff --git a/tests/data/profile_stability/rhel8/pci-dss.profile b/tests/data/profile_stability/rhel8/pci-dss.profile
|
|
|
30eaf1 |
index 5c77ea6a85..902d0084fc 100644
|
|
|
30eaf1 |
--- a/tests/data/profile_stability/rhel8/pci-dss.profile
|
|
|
30eaf1 |
+++ b/tests/data/profile_stability/rhel8/pci-dss.profile
|
|
|
30eaf1 |
@@ -109,7 +109,6 @@ selections:
|
|
|
30eaf1 |
- gid_passwd_group_same
|
|
|
30eaf1 |
- grub2_audit_argument
|
|
|
30eaf1 |
- install_hids
|
|
|
30eaf1 |
-- logind_session_timeout
|
|
|
30eaf1 |
- no_empty_passwords
|
|
|
30eaf1 |
- package_aide_installed
|
|
|
30eaf1 |
- package_audispd-plugins_installed
|
|
|
30eaf1 |
@@ -137,7 +136,6 @@ selections:
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_deny=6
|
|
|
30eaf1 |
- var_accounts_passwords_pam_faillock_unlock_time=1800
|
|
|
30eaf1 |
- sshd_idle_timeout_value=15_minutes
|
|
|
30eaf1 |
-- var_logind_session_timeout=15_minutes
|
|
|
30eaf1 |
- var_password_pam_minlen=7
|
|
|
30eaf1 |
- var_password_pam_minclass=2
|
|
|
30eaf1 |
- var_accounts_maximum_age_login_defs=90
|
|
|
30eaf1 |
--
|
|
|
30eaf1 |
2.39.1
|
|
|
30eaf1 |
|