<Profile id="rht-ccp" xmlns="http://checklists.nist.gov/xccdf/1.1">
<title>Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)</title>
<description>This is a *draft* SCAP profile for Red Hat Certified Cloud Providers</description>
<!-- CONFIGURATION OPTIONS -->
<refine-value idref="var_selinux_state" selector="enforcing"/>
<refine-value idref="var_selinux_policy_name" selector="targeted"/>
<refine-value idref="file_owner_logfiles_value" selector="root"/>
<refine-value idref="file_groupowner_logfiles_value" selector="root"/>
<refine-value idref="sshd_idle_timeout_value" selector="5_minutes"/>
<refine-value idref="var_accounts_password_minlen_login_defs" selector="6"/>
<refine-value idref="var_password_max_age" selector="90"/>
<refine-value idref="var_accounts_minimum_age_login_defs" selector="7"/>
<refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="5" />
<refine-value idref="var_accounts_password_warn_age_login_defs" selector="7"/>
<refine-value idref="var_password_pam_retry" selector="3"/>
<refine-value idref="var_password_pam_dcredit" selector="1"/>
<refine-value idref="var_password_pam_ucredit" selector="2"/>
<refine-value idref="var_password_pam_ocredit" selector="2"/>
<refine-value idref="var_password_pam_lcredit" selector="2"/>
<refine-value idref="var_password_pam_difok" selector="3"/>
<refine-value idref="var_password_pam_unix_remember" selector="5"/>
<refine-value idref="var_accounts_user_umask" selector="077"/>
<refine-value idref="login_banner_text" selector="usgcb_default"/>

<!-- FILESYSTEM CHECKS -->
<select idref="partition_for_tmp" selected="true"/>
<select idref="partition_for_var" selected="true"/>
<select idref="partition_for_var_log" selected="true"/>
<select idref="partition_for_var_log_audit" selected="true"/>

<!-- SELINUX CHECKS -->
<!-- rhel7 broke: <select idref="enable_selinux_bootloader" selected="true"/> -->
<select idref="selinux_state" selected="true"/>
<select idref="selinux_policytype" selected="true"/>
<!-- rhel7 broke: <select idref="selinux_all_devicefiles_labeled" selected="true"/> -->

<!-- UPDATING CHECKS -->
<select idref="ensure_redhat_gpgkey_installed" selected="true"/>
<select idref="security_patches_up_to_date" selected="true"/>
<select idref="ensure_gpgcheck_globally_activated" selected="true"/>
<select idref="ensure_gpgcheck_never_disabled" selected="true"/>

<select idref="package_aide_installed" selected="true"/>

<!-- ACCOUNT MANAGEMENT CHECKS -->
<select idref="accounts_password_pam_unix_remember" selected="true"/>
<select idref="no_shelllogin_for_systemaccounts" selected="true"/>
<select idref="no_empty_passwords" selected="true"/>
<select idref="accounts_password_all_shadowed" selected="true"/>
<select idref="accounts_no_uid_except_zero" selected="true"/>
<select idref="accounts_password_minlen_login_defs" selected="true"/>
<select idref="accounts_minimum_age_login_defs" selected="true"/>
<select idref="accounts_password_warn_age_login_defs" selected="true"/>
<select idref="accounts_password_pam_retry" selected="true"/>
<select idref="accounts_password_pam_dcredit" selected="true"/>
<select idref="accounts_password_pam_ucredit" selected="true"/>
<select idref="accounts_password_pam_ocredit" selected="true"/>
<select idref="accounts_password_pam_lcredit" selected="true"/>
<select idref="accounts_password_pam_difok" selected="true"/>
<select idref="accounts_passwords_pam_faillock_deny" selected="true"/>
<select idref="set_password_hashing_algorithm_systemauth" selected="true"/>
<select idref="set_password_hashing_algorithm_logindefs" selected="true"/>
<select idref="set_password_hashing_algorithm_libuserconf" selected="true"/>
<select idref="require_singleuser_auth" selected="true"/>

<!-- FILE PERMISSION CHECKS -->
<select idref="userowner_shadow_file" selected="true"/>
<select idref="groupowner_shadow_file" selected="true"/>
<select idref="file_permissions_etc_shadow" selected="true"/>
<select idref="file_owner_etc_gshadow" selected="true"/>
<select idref="file_groupowner_etc_gshadow" selected="true"/>
<select idref="file_permissions_etc_gshadow" selected="true"/>
<select idref="file_owner_etc_passwd" selected="true"/>
<select idref="file_groupowner_etc_passwd" selected="true"/>
<select idref="file_permissions_etc_passwd" selected="true"/>
<select idref="file_owner_etc_group" selected="true"/>
<select idref="file_groupowner_etc_group" selected="true"/>
<select idref="file_permissions_etc_group" selected="true"/>
<select idref="file_permissions_library_dirs" selected="true"/>
<select idref="file_ownership_library_dirs" selected="true"/>
<select idref="file_permissions_binary_dirs" selected="true"/>
<select idref="file_ownership_binary_dirs" selected="true"/>
<select idref="file_permissions_var_log_audit" selected="true"/>

<select idref="file_user_owner_grub2_cfg" selected="true"/> 
<select idref="file_group_owner_grub2_cfg" selected="true"/>
<select idref="file_permissions_grub2_cfg" selected="true"/>
<select idref="bootloader_password" selected="true"/>

<!-- KERNEL SETTINGS -->
<select idref="kernel_module_dccp_disabled" selected="true"/>
<select idref="kernel_module_sctp_disabled" selected="true"/>
<select idref="service_firewalld_enabled" selected="true"/>
<select idref="set_firewalld_default_zone" selected="true"/>

<!-- <select idref="sysctl_kernel_randomize_va_space" selected="true"/>
<select idref="enable_execshield" selected="true"/>
<select idref="kernel_module_ipv6_option_disabled" selected="true"/>
<select idref="service_ip6tables_enabled" selected="true"/>

This requirement does not apply against Red Hat Enterprise Linux 7:
see: https://github.com/OpenSCAP/scap-security-guide/issues/66 for details.
<select idref="kernel_module_rds_disabled" selected="true"/>

This requirement does not apply against Red Hat Enterprise Linux 7:
see: https://github.com/OpenSCAP/scap-security-guide/issues/67 for details.
<select idref="kernel_module_tipc_disabled" selected="true"/>

ANTIQUATED SERVICES
<select idref="disable_xinetd" selected="true"/>
<select idref="uninstall_xinetd" selected="true"/>
<select idref="package_rsh-server_removed" selected="true"/>
<select idref="uninstall_ypserv" selected="true"/>
<select idref="disable_ypbind" selected="true"/>
<select idref="uninstall_tftp-server" selected="true"/>
<select idref="service_tftp_disabled" selected="true"/>
<select idref="disable_avahi" selected="true"/>
<select idref="service_atd_disabled" selected="true"/>
<select idref="service_autofs_disabled" selected="true"/>
<select idref="service_ntpdate_disabled" selected="true"/>
<select idref="service_oddjobd_disabled" selected="true"/>
<select idref="service_qpidd_disabled" selected="true"/>
<select idref="service_rdisc_disabled" selected="true"/-->
<select idref="service_abrtd_disabled" selected="true"/>
<select idref="service_telnetd_disabled" selected="true"/>
<select idref="package_telnet_removed" selected="true"/>
<select idref="uninstall_telnet_server" selected="true"/>

<!-- SSH / REMOTE ACCESS CHECKS -->
<select idref="sshd_allow_only_protocol2" selected="true"/>
<select idref="sshd_set_idle_timeout" selected="true"/>
<select idref="sshd_set_keepalive" selected="true"/>
<select idref="sshd_disable_rhosts" selected="true"/>
<select idref="disable_host_auth" selected="true"/>
<select idref="sshd_disable_root_login" selected="true"/>
<select idref="sshd_disable_empty_passwords" selected="true"/>
<select idref="sshd_enable_warning_banner" selected="true"/>
<select idref="sshd_do_not_permit_user_env" selected="true"/>
<select idref="sshd_use_approved_ciphers" selected="true"/>
</Profile>
