<Profile id="C2S">
<title>C2S for Red Hat Enterprise Linux 6</title>
<description>This profile demonstrates compliance against the 
U.S. Government Commercial Cloud Services (C2S) baseline.

This baseline was inspired by the Center for Internet Security
(CIS) Red Hat Enterprise Linux 6 Benchmark, v1.2.0 - 06-25-2013.
For the SCAP Security Guide project to remain in compliance with
CIS' terms and conditions, specifically Restrictions(8), note 
there is no representation or claim that the C2S profile will
ensure a system is in compliance or consistency with the CIS
baseline. 
</description>

<!-- BEGIN REFINE VALUES -->
<refine-value idref="var_selinux_state" selector="enforcing" />
<refine-value idref="var_selinux_policy_name" selector="targeted" />
<refine-value idref="var_umask_for_daemons" selector="027"/>
<refine-value idref="var_accounts_user_umask" selector="027"/>
<refine-value idref="var_accounts_maximum_age_login_defs" selector="90" />
<!-- END REFINE VALUES -->
<!-- No edits past this point should be needed -->


<!-- CIS
1 Install Updates, Patches and Additional Security Software
1.1 Filesystem Configuration -->

<!-- CIS 1.1.1 Create Separate Partition for /tmp (Scored) -->
<select idref="partition_for_tmp" selected="true"/>

<!-- CIS 1.1.2 Set nodev option for /tmp Partition (Scored) -->
<select idref="mount_option_tmp_nodev" selected="true" />

<!-- CIS 1.1.3 Set nosuid option for /tmp Partition (Scored) -->
<select idref="mount_option_tmp_nosuid" selected="true" />

<!-- CIS 1.1.4 Set noexec option for /tmp Partition (Scored) -->
<select idref="mount_option_tmp_noexec" selected="true" />

<!-- CIS 1.1.5 Create Separate Partition for /var (Scored) -->
<select idref="partition_for_var" selected="true"/>

<!-- CIS 1.1.6 Bind Mount the /var/tmp directory to /tmp (Scored) -->
<select idref="mount_option_var_tmp_bind" selected="true" />

<!-- CIS 1.1.7 Create Separate Partition for /var/log -->
<select idref="partition_for_var_log" selected="true"/>

<!-- CIS 1.1.8 Create Separate Partition for /var/log/audit (Scored) -->
<select idref="partition_for_var_log_audit" selected="true"/>

<!-- CIS 1.1.9 Create Separate Partition for /home (Scored) -->
<select idref="partition_for_home" selected="true"/>

<!-- CIS 1.1.10 Add nodev Option to /home (Scored) -->
<select idref="mount_option_nodev_nonroot_local_partitions" selected="true" />

<!-- CIS 1.1.11 Add nodev Option to Removable Media Partitions (Not Scored) -->
<select idref="mount_option_nodev_removable_partitions" selected="true" />

<!-- CIS 1.1.12 Add noexec Option to Removable Media Partitions (Not Scored)  -->
<select idref="mount_option_noexec_removable_partitions" selected="true" />

<!-- CIS 1.1.13 Add nosuid Option to Removable Media Partitions (Not Scored)  -->
<select idref="mount_option_nosuid_removable_partitions" selected="true" />

<!-- CIS 1.1.14 Add nodev Option to /dev/shm Partition (Scored) -->
<select idref="mount_option_dev_shm_nodev" selected="true" />

<!-- CIS 1.1.15 Add nosuid Option to /dev/shm Partition (Scored) -->
<select idref="mount_option_dev_shm_nosuid" selected="true" />

<!-- CIS 1.1.16 Add noexec Option to /dev/shm Partition (Scored)  -->
<select idref="mount_option_dev_shm_noexec" selected="true" />

<!-- CIS 1.1.17 Set Sticky Bit on All World-Writable Directories (Scored) -->
<select idref="sticky_world_writable_dirs" selected="true" />

<!-- CIS 1.1.18 Disable Mounting of cramfs Filesystems (Not Scored) -->
<select idref="kernel_module_cramfs_disabled" selected="true" />

<!-- CIS 1.1.19 Disable Mounting of freevxfs Filesystems (Not Scored) -->
<select idref="kernel_module_freevxfs_disabled" selected="true" />

<!-- CIS 1.1.20 Disable Mounting of jffs2 Filesystems (Not Scored) -->
<select idref="kernel_module_jffs2_disabled" selected="true" />

<!-- CIS 1.1.21 Disable Mounting of hfs Filesystems (Not Scored) -->
<select idref="kernel_module_hfs_disabled" selected="true" /> 

<!-- CIS 1.1.22 Disable Mounting of hfsplus Filesystems (Not Scored) -->
<select idref="kernel_module_hfsplus_disabled" selected="true" />

<!-- CIS 1.1.23 Disable Mounting of squashfs Filesystems (Not Scored) -->
<select idref="kernel_module_squashfs_disabled" selected="true" />

<!-- CIS 1.1.24 Disable Mounting of udf Filesystems (Not Scored) -->
<select idref="kernel_module_udf_disabled" selected="true" />

<!-- CIS 1.2 Configure Software Updates  -->
<!-- CIS 1.2.1 Configure Connection to the RHN RPM Repositories (Not Scored)  -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->

<!-- CIS 1.2.2 Verify Red Hat GPG Key is Installed (Scored) -->
<select idref="ensure_redhat_gpgkey_installed" selected="true"/>

<!-- CIS 1.2.3 Verify that gpgcheck is Globally Activated (Scored) -->
<select idref="ensure_gpgcheck_globally_activated" selected="true"/>
<select idref="ensure_gpgcheck_never_disabled" selected="true"/>

<!-- CIS 1.2.4 Disable the rhnsd Daemon (Not Scored) -->
<select idref="service_rhnsd_disabled" selected="true"/>

<!-- CIS 1.2.5 Obtain Software Package Updates with yum (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->

<!-- CIS 1.2.6 Verify Package Integrity Using RPM (Not Scored) -->
<select idref="rpm_verify_permissions" selected="true" />
<select idref="rpm_verify_hashes" selected="true" />

<!-- CIS 1.3 Advanced Intrusion Detection Environment (AIDE) -->
<!-- CIS 1.3.1 Install AIDE (Scored) -->
<select idref="package_aide_installed" selected="true" />

<!-- CIS 1.3.2 Implement Periodic Execution of File Integrity (Scored) -->
<select idref="disable_prelink" selected="true" />
<select idref="aide_build_database" selected="true" />
<select idref="aide_periodic_cron_checking" selected="true" />

<!-- CIS 1.4 Configure SELinux -->
<!-- CIS 1.4.1 Enable SELinux in /etc/grub.conf (Scored) -->
<select idref="enable_selinux_bootloader" selected="true" />

<!-- CIS 1.4.2 Set the SELinux State (Scored) -->
<select idref="selinux_state" selected="true" />

<!-- CIS 1.4.3 Set the SELinux Policy (Scored) -->
<select idref="selinux_policytype" selected="true" />

<!-- CIS 1.4.4 Remove SETroubleshoot (Scored) -->
<select idref="package_setroubleshoot_removed" selected="true" />

<!-- CIS 1.4.5 Remove MCS Translation Service (mcstrans) (Scored) -->
<select idref="package_mcstrans_removed" selected="true" />

<!-- CIS 1.4.6 Check for Unconfined Daemons (Scored) -->
<select idref="selinux_confinement_of_daemons" selected="true" />

<!-- CIS 1.5 Secure Boot Settings -->
<!-- CIS 1.5.1 Set User/Group Owner on /etc/grub.conf (Scored) -->
<select idref="file_user_owner_grub_conf" selected="true"/>
<select idref="file_group_owner_grub_conf" selected="true"/>

<!-- CIS 1.5.2 Set Permissions on /etc/grub.conf (Scored) -->
<select idref="file_permissions_grub_conf" selected="true"/>

<!-- CIS 1.5.3 Set Boot Loader Password (Scored) --> 
<select idref="bootloader_password" selected="true"/>

<!-- CIS 1.5.4 Require Authentication for Single-User Mode (Scored)  -->
<select idref="require_singleuser_auth" selected="true"/>

<!-- CIS 1.5.5 Disable Interactive Boot (Scored) --> 
<select idref="disable_interactive_boot" selected="true"/>

<!-- CIS 1.6 Additional Process Hardening --> 
<!-- CIS 1.6.1 Restrict Core Dumps (Scored) -->
<select idref="disable_users_coredumps" selected="true" />
<select idref="sysctl_fs_suid_dumpable" selected="true" />

<!-- CIS 1.6.2 Configure ExecShield (Scored) --> 
<select idref="sysctl_kernel_exec_shield" selected="true"/>

<!-- CIS 1.6.3 Enable Randomized Virtual Memory Region Placement (Scored) -->
<select idref="sysctl_kernel_randomize_va_space" selected="true"/>

<!-- CIS 1.7 Use the Latest OS Release (Not Scored) -->
<!-- CIS 2 OS Services -->
<!-- CIS 2.1 Remove Legacy Services  -->
<!-- CIS 2.1.1 Remove telnet-server (Scored)  -->
<select idref="uninstall_telnet_server" selected="true"/>

<!-- CIS 2.1.2 Remove telnet Clients (Scored) -->
<select idref="package_telnet_removed" selected="true" />

<!-- CIS 2.1.3 Remove rsh-server (Scored) -->
<select idref="package_rsh-server_removed" selected="true"/>

<!-- CIS 2.1.4 Remove rsh (Scored) -->
<select idref="package_rsh_removed" selected="true" />

<!-- CIS 2.1.5 Remove NIS Client (Scored) -->
<select idref="package_ypbind_removed" selected="true" />

<!-- CIS 2.1.6 Remove NIS Server (Scored) -->
<select idref="uninstall_ypserv" selected="true" />

<!-- CIS 2.1.7 Remove tftp (Scored) -->
<select idref="package_tftp_removed" selected="true" />

<!-- CIS 2.1.8 Remove tftp-server (Scored) -->
<select idref="uninstall_tftp-server" selected="true"/>

<!-- CIS 2.1.9 Remove talk (Scored) -->
<!-- NEEDS RULE -->

<!-- CIS 2.1.10 Remove talk-server (Scored) -->
<!-- NEEDS RULE -->

<!-- CIS 2.1.11 Remove xinetd (Scored) -->
<select idref="uninstall_xinetd" selected="true"/>

<!-- CIS 2.1.12 Disable chargen-dgram (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->

<!-- CIS 2.1.13 Disable chargen-stream (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->

<!-- CIS 2.1.14 Disable daytime-dgram (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->

<!-- CIS 2.1.15 Disable daytime-stream (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->

<!-- CIS 2.1.16 Disable echo-dgram (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->

<!-- CIS 2.1.17 Disable echo-stream (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->

<!-- CIS 2.1.18 Disable tcpmux-server (Scored) -->
<!-- As this package is not available in RHEL6, not creating a rule -->

<!-- CIS 3 Special Purpose Services -->
<!-- CIS 3.1 Set Daemon umask (Scored) -->
<select idref="umask_for_daemons" selected="true" />

<!-- CIS 3.2 Remove X Windows (Scored) -->
<select idref="packagegroup_xwindows_remove" selected="true" />

<!-- CIS 3.3 Disable Avahi Server (Scored) --> 
<select idref="disable_avahi" selected="true" />

<!-- CIS 3.4 Disable Print Server - CUPS (Not Scored) --> 
<select idref="service_cups_disabled" selected="true" />

<!-- CIS 3.5 Remove DHCP Server (Scored) --> 
<select idref="uninstall_dhcp_server" selected="true" />

<!-- CIS 3.6 Configure Network Time Protocol (NTP) (Scored) -->
<select idref="service_ntpd_enabled" selected="true" />
<select idref="ntpd_specify_remote_server" selected="true" />
<select idref="ntpd_specify_multiple_servers" selected="true" />

<!-- CIS 3.7 Remove LDAP (Not Scored) -->
<select idref="package_openldap-servers_removed" selected="true" />

<!-- CIS 3.8 Disable NFS and RPC (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->

<!-- CIS 3.9 Remove DNS Server (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->

<!-- CIS 3.10 Remove FTP Server (Not Scored) -->
<select idref="uninstall_vsftpd" selected="true" />

<!-- CIS 3.11 Remove HTTP Server (Not Scored) -->
<select idref="package_httpd_removed" selected="true" />

<!-- CIS 3.12 Remove Dovecot (IMAP and POP3 services) (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->

<!-- CIS 3.13 Remove Samba (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->

<!-- CIS 3.14 Remove HTTP Proxy Server (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->

<!-- CIS 3.15 Remove SNMP Server (Not Scored) -->
<select idref="package_net-snmp_removed" selected="true"/>

<!-- CIS 3.16 Configure Mail Transfer Agent for Local-Only Mode (Scored) -->
<select idref="postfix_network_listening_disabled" selected="true" />

<!-- CIS 4 Network Configuration and Firewalls -->
<!-- CIS 4.1 Modify Network Parameters (Host Only) -->
<!-- CIS4.1.1 Disable IP Forwarding (Scored) -->
<select idref="sysctl_ipv4_ip_forward" selected="true"/>

<!-- CIS4.1.2 Disable Send Packet Redirects (Scored) -->
<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_conf_all_send_redirects" selected="true"/>

<!-- CIS 4.2 Modify Network Parameters (Host and Router) -->
<!-- CIS 4.2.1 Disable Source Routed Packet Acceptance (Scored) -->
<select idref="sysctl_net_ipv4_conf_all_accept_source_route" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true"/>

<!-- CIS 4.2.2 Disable ICMP Redirect Acceptance (Scored) -->
<select idref="sysctl_net_ipv4_conf_all_accept_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true"/>

<!-- CIS 4.2.3 Disable Secure ICMP Redirect Acceptance (Scored)-->
<select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_secure_redirects" selected="true"/>

<!-- CIS 4.2.4 Log Suspicious Packets (Scored) -->
<select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true"/>

<!-- CIS 4.2.5 Enable Ignore Broadcast Requests (Scored) -->
<select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true"/>

<!-- CIS 4.2.6 Enable Bad Error Message Protection (Scored) -->
<select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true"/>

<!-- CIS 4.2.7 Enable RFC-recommended Source Route Validation (Scored)-->
<select idref="sysctl_net_ipv4_conf_all_rp_filter" selected="true"/>
<select idref="sysctl_net_ipv4_conf_default_rp_filter" selected="true"/>

<!-- CIS 4.2.8 Enable TCP SYN Cookies (Scored) -->
<select idref="sysctl_net_ipv4_tcp_syncookies" selected="true"/>

<!-- CIS 4.3 Wireless Networking -->
<!-- CIS 4.3.1 Deactivate Wireless Interfaces (Not Scored) -->
<select idref="wireless_disable_in_bios" selected="true" />
<select idref="deactivate_wireless_interfaces" selected="true" />

<!-- CIS 4.4 Disable IPv6 -->
<!-- CIS 4.4.1 Configure IPv6 -->
<!-- CIS 4.4.1.1 Disable IPv6 Router Advertisements (Not Scored) -->
<select idref="sysctl_net_ipv6_conf_default_accept_ra" selected="true" />
<!-- NEEDS: net.ipv6.conf.all.accept_ra -->

<!-- CIS 4.4.1.2 Disable IPv6 Redirect Acceptance (Not Scored) -->
<select idref="sysctl_net_ipv6_conf_default_accept_redirects" selected="true" />
<!-- NEEDS: net.ipv6.conf.default.accept_redirects -->

<!-- CIS 4.4.2 Disable IPv6 (Not Scored) -->
<select idref="network_ipv6_disable_interfaces" selected="true" />

<!-- CIS 4.5 Install TCP Wrappers -->
<!-- CIS 4.5.1 Install TCP Wrappers (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->

<!-- CIS 4.5.2 Create /etc/hosts.allow (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->

<!-- CIS 4.5.3 Verify Permissions on /etc/hosts.allow (Scored) -->
<!-- This rule is met through RPM Verify, will add mappings later -->

<!-- CIS 4.5.4 Create /etc/hosts.deny (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->

<!-- CIS 4.5.5 Verify Permissions on /etc/hosts.deny (Scored)-->
<!-- This rule is met through RPM Verify, will add mappings later -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED -->

<!-- CIS 4.6 Uncommon Network Protocols-->
<!-- CIS 4.6.1 Disable DCCP (Not Scored) -->
<select idref="kernel_module_dccp_disabled" selected="true"/>

<!-- CIS 4.6.2 Disable SCTP (Not Scored) -->
<select idref="kernel_module_sctp_disabled" selected="true"/>

<!-- CIS 4.6.3 Disable RDS (Not Scored) -->
<select idref="kernel_module_rds_disabled" selected="true"/>

<!-- CIS 4.6.4 Disable TIPC (Not Scored) -->
<select idref="kernel_module_tipc_disabled" selected="true"/>

<!-- CIS 4.7 Enable IPtables (Scored) -->
<select idref="service_iptables_enabled" selected="true"/>

<!-- CIS 4.8 Enable IP6tables (Not Scored) -->
<select idref="service_ip6tables_enabled" selected="true"/>

<!-- CIS 5 Logging and Auditing-->
<!-- CIS 5.1 Configure rsyslog -->
<!-- CIS 5.1.1 Install the rsyslog package (Scored) -->
<select idref="package_rsyslog_installed" selected="true"/>

<!-- CIS 5.1.2 Activate the rsyslog Service (Scored) -->
<select idref="service_rsyslog_enabled" selected="true"/>

<!-- CIS 5.1.3 Configure /etc/rsyslog.conf (Not Scored) -->
<!-- NEEDS RULE. LOW PRIORITY SINCE NOT SCORED. -->

<!-- CIS 5.1.4 Create and Set Permissions on rsyslog Log Files (Scored)-->
<select idref="rsyslog_file_permissions" selected="true"/>

<!-- CIS 5.1.5 Configure rsyslog to Send Logs to a Remote Log Host (Scored) -->
<select idref="rsyslog_send_messages_to_logserver" selected="true"/>

<!-- CIS 5.1.6 Accept Remote rsyslog Messages Only on Designated Log Hosts (Not Scored) -->
<select idref="rsyslog_accept_remote_messages_none" selected="true" />

<!-- CIS 5.2 Configure System Accounting (auditd) -->
<!-- CIS 5.2.1 Configure Data Retention -->
<!-- CIS 5.2.1.1 Configure Audit Log Storage Size (Not Scored) -->
<select idref="auditd_data_retention_max_log_file" selected="true"/>

<!-- CIS 5.2.1.2 Disable System on Audit Log Full (Not Scored) -->
<select idref="auditd_data_retention_space_left_action" selected="true" />
<select idref="auditd_data_retention_action_mail_acct" selected="true" />
<select idref="auditd_data_retention_admin_space_left_action" selected="true" />

<!-- CIS 5.2.1.3 Keep All Auditing Information (Scored) -->
<select idref="auditd_data_retention_max_log_file_action" selected="true" />

<!-- CIS 5.2.2 Enable auditd Service (Scored) -->
<select idref="service_auditd_enabled" selected="true"/>

<!-- CIS 5.2.3 Enable Auditing for Processes That Start Prior to auditd (Scored) -->
<select idref="bootloader_audit_argument" selected="true"/>

<!-- CIS 5.2.4 Record Events That Modify Date and Time Information (Scored) -->
<select idref="audit_rules_time_adjtimex" selected="true" />
<select idref="audit_rules_time_settimeofday" selected="true" />
<select idref="audit_rules_time_stime" selected="true" />
<select idref="audit_rules_time_watch_localtime" selected="true" />

<!-- CIS 5.2.5 Record Events That Modify User/Group Information (Scored) -->
<select idref="audit_rules_usergroup_modification" selected="true" />

<!-- CIS 5.2.6 Record Events That Modify the System's Network Environment (Scored) -->
<select idref="audit_rules_networkconfig_modification" selected="true" />

<!-- CIS 5.2.7 Record Events That Modify the System's Mandatory Access Controls (Scored) -->
<select idref="audit_rules_mac_modification" selected="true" />

<!-- CIS 5.2.8 Collect Login and Logout Events (Scored) -->
<select idref="audit_rules_login_events" selected="true" />

<!-- CIS 5.2.9 Collect Session Initiation Information (Scored) -->
<select idref="audit_rules_session_events" selected="true" />

<!-- CIS 5.2.10 Collect Discretionary Access Control Permission Modification Events (Scored)-->
<select idref="audit_dac_actions" selected="true" />

<!-- CIS 5.2.11 Collect Unsuccessful Unauthorized Access Attempts to Files (Scored) -->
<select idref="audit_rules_unsuccessful_file_modification" selected="true" />

<!-- CIS 5.2.12 Collect Use of Privileged Commands (Scored) -->
<select idref="audit_rules_privileged_commands" selected="true" />

<!-- CIS 5.2.13 Collect Successful File System Mounts (Scored)-->
<select idref="audit_rules_media_export" selected="true" />

<!-- CIS 5.2.14 Collect File Deletion Events by User (Scored) -->
<select idref="audit_rules_file_deletion_events" selected="true" />

<!-- CIS 5.2.15 Collect Changes to System Administration Scope (sudoers) (Scored) -->
<select idref="audit_rules_sysadmin_actions" selected="true" />

<!-- CIS 5.2.16 Collect System Administrator Actions (sudolog) (Scored) -->
<!-- NEEDS RULE -->
<!-- sdw/jb: this rule is wrong. will work with CIS to correct in future editions -->

<!-- CIS 5.2.17 Collect Kernel Module Loading and Unloading (Scored) -->
<select idref="audit_rules_kernel_module_loading" selected="true" />

<!-- CIS 5.2.18 Make the Audit Configuration Immutable (Scored) -->
<select idref="audit_rules_immutable" selected="true" />

<!-- CIS 5.3 Configure logrotate (Not Scored) -->
<select idref="ensure_logrotate_activated" selected="true" />

<!-- CIS 6 System Access, Authentication and Authorization -->
<!-- CIS 6.1 Configure cron and anacron -->
<!-- CIS 6.1.1 Enable anacron Daemon (Scored) -->
<!-- NEEDS RULE -->
<!-- Low priority, given anacron is enabled by default -->
<!-- ... and the security relevance is not clear ... -->

<!-- CIS 6.1.2 Enable crond Daemon (Scored) -->
<select idref="service_crond_enabled" selected="true" />

<!-- CIS 6.1.3 Set User/Group Owner and Permission on /etc/anacrontab (Scored) -->
<!-- Taken care of via RPM verify -->

<!-- CIS 6.1.4 Set User/Group Owner and Permission on /etc/crontab (Scored) -->
<!-- Taken care of via RPM verify -->

<!-- CIS 6.1.5 Set User/Group Owner and Permission on /etc/cron.hourly (Scored) -->
<!-- Taken care of via RPM verify -->

<!-- CIS 6.1.6 Set User/Group Owner and Permission on /etc/cron.daily (Scored) -->
<!-- Taken care of via RPM verify -->

<!-- CIS 6.1.7 Set User/Group Owner and Permission on /etc/cron.weekly (Scored) -->
<!-- Taken care of via RPM verify -->

<!-- CIS 6.1.8 Set User/Group Owner and Permission on /etc/cron.monthly (Scored) -->
<!-- Taken care of via RPM verify -->

<!-- CIS 6.1.9 Set User/Group Owner and Permission on /etc/cron.d (Scored) -->
<!-- Taken care of via RPM verify -->

<!-- CIS 6.1.10 Restrict at Daemon (Scored) -->
<select idref="service_atd_disabled" selected="true" />

<!-- CIS 6.1.11 Restrict at/cron to Authorized Users (Scored) -->
<!-- Handled by rule immediately above -->

<!-- CIS 6.2 Configure SSH -->
<!-- CIS 6.2.1 Set SSH Protocol to 2 (Scored) -->
<select idref="sshd_allow_only_protocol2" selected="true" />

<!-- CIS 6.2.2 Set LogLevel to INFO (Scored) -->
<!-- Default, non-configurable system behavior, will audit user login/logout events -->

<!-- CIS 6.2.3 Set Permissions on /etc/ssh/sshd_config (Scored) -->
<!-- Met via RPM Verify rule -->

<!-- CIS 6.2.4 Disable SSH X11 Forwarding (Scored)-->
<!-- Met through removal of X11 via Section 3.2 -->

<!-- CIS 6.2.5 Set SSH MaxAuthTries to 4 or Less (Scored) -->
<!-- Met via 6.3.2 Set Password Creation Requirement Parameters Using pam_cracklib -->

<!-- CIS 6.2.6 Set SSH IgnoreRhosts to Yes (Scored) -->
<select idref="sshd_disable_rhosts" selected="true" />

<!-- CIS 6.2.7 Set SSH HostbasedAuthentication to No (Scored) -->
<select idref="disable_host_auth" selected="true" />

<!-- CIS 6.2.8 Disable SSH Root Login (Scored) -->
<select idref="sshd_disable_root_login" selected="true" />

<!-- CIS 6.2.9 Set SSH PermitEmptyPasswords to No (Scored) -->
<select idref="sshd_disable_empty_passwords" selected="true" />

<!-- CIS 6.2.10 Do Not Allow Users to Set Environment Options (Scored) -->
<!-- CIS 6.2.11 Use Only Approved Cipher in Counter Mode (Scored) -->
<select idref="sshd_use_approved_ciphers" selected="true" />

<!-- CIS 6.2.12 Set Idle Timeout Interval for User Login (Scored) -->
<select idref="sshd_set_idle_timeout" selected="true" />

<!-- CIS 6.2.13 Limit Access via SSH (Scored)-->
<select idref="sshd_limit_user_access" selected="true" />

<!-- CIS 6.2.14 Set SSH Banner (Scored) -->
<select idref="sshd_enable_warning_banner" selected="true" />

<!-- CIS 6.3 Configure PAM -->
<!-- CIS 6.3.1 Upgrade Password Hashing Algorithm to SHA-512 (Scored) -->
<select idref="set_password_hashing_algorithm" selected="true" />

<!-- CIS 6.3.2 Set Password Creation Requirement Parameters Using pam_cracklib (Scored) 142 -->
<select idref="password_quality_pamcracklib" selected="true" />

<!-- CIS 6.3.3 Set Lockout for Failed Password Attempts (Not Scored) -->
<select idref="accounts_passwords_pam_faillock_deny" selected="true" />

<!-- CIS 6.3.4 Limit Password Reuse (Scored) -->
<select idref="accounts_password_pam_unix_remember" selected="true" />

<!-- CIS 6.4 Restrict root Login to System Console (Not Scored) -->
<select idref="no_direct_root_logins" selected="true" />

<!-- CIS 6.5 Restrict Access to the su Command (Scored) -->
<!-- This rule was inherited from the RHEL5 STIG, which provided misinterpretted 
     guidance that sudo users must be in the "wheel" group. This guidance
     has since been removed. Will work with CIS to drop this requirement -->

<!-- CIS 7 User Accounts and Environment -->
<!-- CIS 7.1 Set Shadow Password Suite Parameters (/etc/login.defs) -->
<!-- CIS 7.1.1 Set Password Expiration Days (Scored) -->
<select idref="accounts_maximum_age_login_defs" selected="true" />

<!-- CIS 7.1.2 Set Password Change Minimum Number of Days (Scored) -->
<select idref="accounts_minimum_age_login_defs" selected="true" />

<!-- CIS 7.1.3 Set Password Expiring Warning Days (Scored) -->
<select idref="accounts_password_warn_age_login_defs" selected="true" />

<!-- CIS 7.2 Disable System Accounts (Scored) -->
<select idref="no_shelllogin_for_systemaccounts" selected="true" />

<!-- CIS 7.3 Set Default Group for root Account (Scored) -->
<!-- The system default is GID 0. Any alterations
     will be audited via 5.2.5 "Record Events That
     Modify User/Group Information" -->

<!-- CIS 7.4 Set Default umask for Users (Scored) -->
<select idref="accounts_umask_bashrc" selected="true" />
<select idref="accounts_umask_etc_profile" selected="true" />

<!-- CIS 7.5 Lock Inactive User Accounts (Scored) -->
<select idref="account_disable_post_pw_expiration" selected="true" />

<!-- CIS 8 Warning Banners -->

<!-- CIS 8.1 Set Warning Banner for Standard Login Services (Scored) -->
<select idref="banner_etc_issue" selected="true" />

<!-- CIS 8.2 Remove OS Information from Login Warning Banners (Scored) -->
<!-- Handled in Section 8.1 -->

<!-- CIS 8.3 Set GNOME Warning Banner (Not Scored) -->
<select idref="gconf_gdm_enable_warning_gui_banner" selected="true" />
<select idref="gconf_gdm_set_login_banner_text" selected="true" />

<!-- CIS 9 System Maintenance -->
<!-- CIS 9.1 Verify System File Permissions -->
<!-- CIS 9.1.1 Verify System File Permissions (Not Scored) -->
<!-- Duplicate of 1.2.6 -->

<!-- CIS 9.1.2 Verify Permissions on /etc/passwd (Scored) -->
<select idref="file_permissions_etc_passwd" selected="true" />

<!-- CIS 9.1.3 Verify Permissions on /etc/shadow (Scored) -->
<select idref="file_permissions_etc_shadow" selected="true" />

<!-- CIS 9.1.4 Verify Permissions on /etc/gshadow (Scored) -->
<select idref="file_permissions_etc_gshadow" selected="true" />

<!-- CIS 9.1.5 Verify Permissions on /etc/group (Scored) -->
<select idref="file_permissions_etc_group" selected="true" />

<!-- CIS 9.1.6 Verify User/Group Ownership on /etc/passwd (Scored) -->
<select idref="file_owner_etc_passwd" selected="true" />
<select idref="file_groupowner_etc_passwd" selected="true" />

<!-- CIS 9.1.7 Verify User/Group Ownership on /etc/shadow (Scored) -->
<select idref="userowner_shadow_file" selected="true" />
<select idref="groupowner_shadow_file" selected="true" />

<!-- CIS 9.1.8 Verify User/Group Ownership on /etc/gshadow (Scored) -->
<select idref="file_owner_etc_gshadow" selected="true" />
<select idref="file_groupowner_etc_gshadow" selected="true" />

<!-- CIS 9.1.9 Verify User/Group Ownership on /etc/group (Scored) -->
<select idref="file_owner_etc_group" selected="true" />
<select idref="file_groupowner_etc_group" selected="true" />

<!-- CIS 9.1.10 Find World Writable Files (Not Scored) -->
<select idref="file_permissions_binary_dirs" selected="true" />
<select idref="world_writeable_files" selected="true" />

<!-- CIS 9.1.11 Find Un-owned Files and Directories (Scored) -->
<select idref="no_files_unowned_by_user" selected="true" />

<!-- CIS 9.1.12 Find Un-grouped Files and Directories (Scored) -->
<select idref="no_files_unowned_by_group" selected="true" />

<!-- CIS 9.1.13 Find SUID System Executables (Not Scored) -->
<select idref="file_permissions_unauthorized_suid" selected="true" />

<!-- CIS 9.1.14 Find SGID System Executables (Not Scored) -->
<select idref="file_permissions_unauthorized_sgid" selected="true" />

<!-- CIS 9.2 Review User and Group Settings -->
<!-- CIS 9.2.1 Ensure Password Fields are Not Empty (Scored) -->
<select idref="no_empty_passwords" selected="true" />

<!-- CIS 9.2.2 Verify No Legacy "+" Entries Exist in /etc/passwd File (Scored) -->
<!-- Addressed from removal of NIS in "2.1.6 Remove NIS Server" -->

<!-- CIS 9.2.3 Verify No Legacy "+" Entries Exist in /etc/shadow File (Scored) -->
<!-- Addressed from removal of NIS in "2.1.6 Remove NIS Server" -->

<!-- CIS 9.2.4 Verify No Legacy "+" Entries Exist in /etc/group File (Scored) -->
<!-- Addressed from removal of NIS in "2.1.6 Remove NIS Server" -->

<!-- CIS 9.2.5 Verify No UID 0 Accounts Exist Other Than root (Scored) -->
<select idref="accounts_no_uid_except_zero" selected="true" />

<!-- CIS 9.2.6 Ensure root PATH Integrity (Scored) -->
<select idref="root_path_default" selected="true" />

<!-- CIS 9.2.7 Check Permissions on User Home Directories (Scored) -->
<select idref="homedir_perms_no_groupwrite_worldread" selected="true" />

<!-- CIS 9.2.8 Check User Dot File Permissions (Scored) -->
<!-- Addressed via  9.1.10 Find World Writable Files -->

<!-- CIS 9.2.9 Check Permissions on User .netrc Files (Scored)-->
<!-- Addressed via  9.1.10 Find World Writable Files -->

<!-- CIS 9.2.10 Check for Presence of User .rhosts Files (Scored) -->
<select idref="no_rsh_trust_files" selected="true" />

<!-- CIS 9.2.11 Check Groups in /etc/passwd (Scored) -->
<select idref="gid_passwd_group_same" selected="true" />

<!-- CIS 9.2.12 Check That Users Are Assigned Valid Home Directories (Scored) -->
<!-- The useradd tool addresses this problem natively. Will work with CIS
     to remove this check -->

<!-- CIS 9.2.13 Check User Home Directory Ownership (Scored) -->
<!-- Default system behavior reflects that if user does not
     own their assigned home directory, they will not
     have privileges upon it -->

<!-- CIS 9.2.14 Check for Duplicate UIDs (Scored)-->
<select idref="account_unique_name" selected="true" />

<!-- CIS 9.2.15 Check for Duplicate GIDs (Scored) -->
<!-- Duplicate of 9.2.14 -->

<!-- CIS 9.2.16 Check That Reserved UIDs Are Assigned to System Accounts (Scored) -->
<!-- Duplicate of 9.2.14 -->

<!-- CIS 9.2.17 Check for Duplicate User Names (Scored) -->
<!-- Duplicate of 9.2.14 -->

<!-- CIS 9.2.18 Check for Duplicate Group Names (Scored) -->
<!-- CIS Duplicate of 9.2.14 -->

<!-- CIS 9.2.19 Check for Presence of User .netrc Files (Scored) -->
<select idref="no_netrc_files" selected="true" />

<!-- CIS 9.2.20 Check for Presence of User .forward Files (Scored) -->
<!-- This rule was inherited from RHEL5 STIG guidance, and since removed
     from industry best practices. Will work with CIS to remove requirement. -->

</Profile>
