From 775dec7b479f9fa900fa46d174b202efc14407fa Mon Sep 17 00:00:00 2001 From: Watson Sato Date: Mon, 13 Feb 2023 11:14:40 +0100 Subject: [PATCH 6/6] remove rule logind_session_timeout and associated variable from profiles Patch-name: scap-security-guide-0.1.67-remove_logind_session_timeout_from_profiles-PR_10202.patch Patch-status: remove rule logind_session_timeout and associated variable from profiles --- controls/anssi.yml | 2 -- products/rhel8/profiles/cjis.profile | 2 -- products/rhel8/profiles/ospp.profile | 2 -- products/rhel8/profiles/pci-dss.profile | 2 -- products/rhel8/profiles/rht-ccp.profile | 2 -- tests/data/profile_stability/rhel8/ospp.profile | 2 -- tests/data/profile_stability/rhel8/pci-dss.profile | 2 -- 7 files changed, 14 deletions(-) diff --git a/controls/anssi.yml b/controls/anssi.yml index 607ce976ef..9e631d1de4 100644 --- a/controls/anssi.yml +++ b/controls/anssi.yml @@ -676,8 +676,6 @@ controls: - var_accounts_tmout=10_min - sshd_set_idle_timeout - sshd_idle_timeout_value=10_minutes - - logind_session_timeout - - var_logind_session_timeout=10_minutes - sshd_set_keepalive - id: R30 diff --git a/products/rhel8/profiles/cjis.profile b/products/rhel8/profiles/cjis.profile index f60b65bc06..18394802b9 100644 --- a/products/rhel8/profiles/cjis.profile +++ b/products/rhel8/profiles/cjis.profile @@ -104,7 +104,6 @@ selections: - sshd_allow_only_protocol2 - sshd_set_idle_timeout - var_sshd_set_keepalive=0 - - logind_session_timeout - sshd_set_keepalive_0 - disable_host_auth - sshd_disable_root_login @@ -120,7 +119,6 @@ selections: - set_firewalld_default_zone - firewalld_sshd_port_enabled - sshd_idle_timeout_value=30_minutes - - var_logind_session_timeout=30_minutes - inactivity_timeout_value=30_minutes - sysctl_net_ipv4_conf_default_accept_source_route - sysctl_net_ipv4_tcp_syncookies diff --git a/products/rhel8/profiles/ospp.profile b/products/rhel8/profiles/ospp.profile index 0fe17b2085..fb46ab4c0c 100644 --- a/products/rhel8/profiles/ospp.profile +++ b/products/rhel8/profiles/ospp.profile @@ -300,8 +300,6 @@ selections: ## We deliberately set sshd timeout to 1 minute before tmux lock timeout - sshd_idle_timeout_value=14_minutes - sshd_set_idle_timeout - - logind_session_timeout - - var_logind_session_timeout=14_minutes ## Disable Unauthenticated Login (such as Guest Accounts) ## FIA_UAU.1 diff --git a/products/rhel8/profiles/pci-dss.profile b/products/rhel8/profiles/pci-dss.profile index c63c5f4a07..c0c9b12773 100644 --- a/products/rhel8/profiles/pci-dss.profile +++ b/products/rhel8/profiles/pci-dss.profile @@ -17,7 +17,6 @@ selections: - var_accounts_passwords_pam_faillock_deny=6 - var_accounts_passwords_pam_faillock_unlock_time=1800 - sshd_idle_timeout_value=15_minutes - - var_logind_session_timeout=15_minutes - var_password_pam_minlen=7 - var_password_pam_minclass=2 - var_accounts_maximum_age_login_defs=90 @@ -110,7 +109,6 @@ selections: - dconf_gnome_screensaver_lock_enabled - dconf_gnome_screensaver_mode_blank - sshd_set_idle_timeout - - logind_session_timeout - var_sshd_set_keepalive=0 - sshd_set_keepalive_0 - accounts_password_pam_minlen diff --git a/products/rhel8/profiles/rht-ccp.profile b/products/rhel8/profiles/rht-ccp.profile index 0a00d2f46b..775727e885 100644 --- a/products/rhel8/profiles/rht-ccp.profile +++ b/products/rhel8/profiles/rht-ccp.profile @@ -12,7 +12,6 @@ selections: - var_selinux_state=enforcing - var_selinux_policy_name=targeted - sshd_idle_timeout_value=5_minutes - - var_logind_session_timeout=5_minutes - var_accounts_minimum_age_login_defs=7 - var_accounts_passwords_pam_faillock_deny=5 - var_accounts_password_warn_age_login_defs=7 @@ -89,7 +88,6 @@ selections: - package_telnet_removed - sshd_allow_only_protocol2 - sshd_set_idle_timeout - - logind_session_timeout - var_sshd_set_keepalive=0 - sshd_set_keepalive_0 - disable_host_auth diff --git a/tests/data/profile_stability/rhel8/ospp.profile b/tests/data/profile_stability/rhel8/ospp.profile index a31f3245d8..267b66a4f8 100644 --- a/tests/data/profile_stability/rhel8/ospp.profile +++ b/tests/data/profile_stability/rhel8/ospp.profile @@ -104,7 +104,6 @@ selections: - kernel_module_firewire-core_disabled - kernel_module_sctp_disabled - kernel_module_tipc_disabled -- logind_session_timeout - mount_option_boot_nodev - mount_option_boot_nosuid - mount_option_dev_shm_nodev @@ -254,7 +253,6 @@ selections: - var_password_pam_ucredit=1 - var_password_pam_lcredit=1 - sshd_idle_timeout_value=14_minutes -- var_logind_session_timeout=14_minutes - var_accounts_passwords_pam_faillock_deny=3 - var_accounts_passwords_pam_faillock_fail_interval=900 - var_accounts_passwords_pam_faillock_unlock_time=never diff --git a/tests/data/profile_stability/rhel8/pci-dss.profile b/tests/data/profile_stability/rhel8/pci-dss.profile index 5c77ea6a85..902d0084fc 100644 --- a/tests/data/profile_stability/rhel8/pci-dss.profile +++ b/tests/data/profile_stability/rhel8/pci-dss.profile @@ -109,7 +109,6 @@ selections: - gid_passwd_group_same - grub2_audit_argument - install_hids -- logind_session_timeout - no_empty_passwords - package_aide_installed - package_audispd-plugins_installed @@ -137,7 +136,6 @@ selections: - var_accounts_passwords_pam_faillock_deny=6 - var_accounts_passwords_pam_faillock_unlock_time=1800 - sshd_idle_timeout_value=15_minutes -- var_logind_session_timeout=15_minutes - var_password_pam_minlen=7 - var_password_pam_minclass=2 - var_accounts_maximum_age_login_defs=90 -- 2.39.1