From 44976b5fda0f34e78a0a0764add645212bd4e26d Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:08:56 +0200
Subject: [PATCH 1/4] remove automated: yes for 1.1.6, rule is missing
---
controls/cis_rhel7.yml | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 6a333693fb..7298158ad3 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -95,8 +95,7 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: yes
-# rules:
+ automated: no # rule missing
- id: 1.1.7
title: Ensure noexec option set on /dev/shm partition (Automated)
From 4dcbe4b2d4a9c14527edd06e90809630877d97aa Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:21:20 +0200
Subject: [PATCH 2/4] add rule for 3.5.1.5 - firewalld default zone
---
controls/cis_rhel7.yml | 4 +++-
.../ruleset_modifications/set_firewalld_default_zone/rule.yml | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 7298158ad3..0f3cec2a83 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -1022,7 +1022,9 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: no # no exact rule is present
+ automated: yes
+ rules:
+ - set_firewalld_default_zone
- id: 3.5.1.6
title: Ensure network interfaces are assigned to appropriate zone (Manual)
diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
index 48de06c5bc..f4d78fb7a1 100644
--- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
+++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml
@@ -27,6 +27,7 @@ identifiers:
references:
cis-csc: 11,14,3,9
+ cis@rhel7: 3.5.1.5
cis@rhel8: 3.4.2.4
cis@sle15: 3.5.1.5
cjis: 5.10.1
From a13a796ee8c33ae98e93072bfc7ee15182bdfb5c Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:45:52 +0200
Subject: [PATCH 3/4] partially cover 5.5.1.4
---
controls/cis_rhel7.yml | 5 ++++-
.../account_disable_post_pw_expiration/rule.yml | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 0f3cec2a83..78ac34817f 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -1966,7 +1966,10 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: no # rule missing
+ automated: partially # we do not check /et/shadow
+ rules:
+ - account_disable_post_pw_expiration
+ - var_account_disable_post_pw_expiration=30
- id: 5.5.1.5
title: Ensure all users last password change date is in the past (Automated)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
index 310e234d43..a3d81cf73f 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml
@@ -34,7 +34,7 @@ identifiers:
references:
cis-csc: 1,12,13,14,15,16,18,3,5,7,8
- cis@rhel7: 5.4.1.4
+ cis@rhel7: 5.5.1.4
cis@rhel8: 5.5.1.4
cis@ubuntu2004: 5.4.1.4
cjis: 5.6.2.1.1
From 31ecc1b5806e7bc14199904b0a4e4d7b027ef7c4 Mon Sep 17 00:00:00 2001
From: Vojtech Polasek <vpolasek@redhat.com>
Date: Thu, 12 Aug 2021 11:52:09 +0200
Subject: [PATCH 4/4] automate 6.2.5
---
controls/cis_rhel7.yml | 4 +++-
.../account_expiration/account_unique_name/rule.yml | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml
index 78ac34817f..672b96cbeb 100644
--- a/controls/cis_rhel7.yml
+++ b/controls/cis_rhel7.yml
@@ -2205,7 +2205,9 @@ controls:
levels:
- l1_server
- l1_workstation
- automated: no # rule missing
+ automated: yes
+ rules:
+ - account_unique_name
- id: 6.2.6
title: Ensure no duplicate group names exist (Automated)
diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
index 484b3c4f90..5f6377f194 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_unique_name/rule.yml
@@ -20,6 +20,7 @@ identifiers:
cce@rhel9: CCE-83628-8
references:
+ cis@rhel7: 6.2.5
cis@rhel8: 6.2.17
cjis: 5.5.2
disa: CCI-000770,CCI-000804