<Profile id="nist-cl-il-al" extends="common">
<title override="true">CNSSI 1253 Low/Low/Low</title>
<description override="true">This profile follows the Committee on National Security Systems Instruction
(CNSSI) No. 1253, "Security Categorization and Control Selection for National Security
Systems" on security controls to meet low confidentiality, low integrity, and low
assurance."</description>

<!--                                                                                   -->
<!--                                                                                   -->
<!-- The following variables must be configured against organization-defined settings  -->

<!--	AC-2(2): The information system automatically terminates temporary and emergency
     	accounts after [Assignment: organization-defined time period for each type of
     	account].

	AC-2(3): The information system automatically disables inactive accounts after
	[Assignment: organization-defined time period] -->

<!-- sdw -->
<refine-value idref="var_account_disable_post_pw_expiration" selector="40" />

<!--	AC-3:	"Access control policies... and access control mechanisms... are
     	employed by organizations to control access between users... and objects.

	To meet this, SELinux *must* be enabled and configured against either
	"targeted" or "mls" mode -->
<refine-value idref="var_selinux_state" selector="enforcing" />
<refine-value idref="var_selinux_policy_name" selector="targeted" />

<!--	AC-4:	TBD 

	-->
<refine-value idref="sysctl_net_ipv4_conf_all_secure_redirects_value" selector="1" />


<!--	AC-6: Least privilege

	Optional values for the umask are "022" or "027" -->
<refine-value idref="var_umask_for_daemons" selector="022" />

<!--	AC-7(a): Enforces a limit of [Assignment: organization-defined number]
     	consecutive invalid login attempts by a user during a [Assignment: organization-
     	defined time period]; and

	Valid options for the consecutive invalid login attempts: 3, 5, or 10
	(var_accounts_passwords_pam_faillock_deny)

	Valid options for time interval:
	(var_accounts_passwords_pam_faillock_fail_interval) 
		- 900		(15 minutes)
		- 1800		(30 minutes)
		- 3600		(1 hour)
		- 86400		(1 day)
		- 100000000	(3.1 years) -->
<refine-value idref="var_accounts_passwords_pam_faillock_deny" selector="3" />
<refine-value idref="var_accounts_passwords_pam_faillock_fail_interval" selector="900" />

<!--	AC-7(b): Automatically [Selection: locks the account/node for an [Assignment:
     	organization-defined time period]; locks the account/node until released by an
     	administrator; delays next login prompt according to [Assignment: organization-
     	defined delay algorithm]] when the maximum number of unsuccessful attempts is
     	exceeded. The control applies regardless of whether the login occurs via a
     	local or network connection

	The accepted behavior is to issue an "account lock" for an organization-defined
	time period. Valid options for time interval:
	(var_accounts_passwords_pam_faillock_unlock_time)
	                - 900           (15 minutes)
	                - 1800          (30 minutes)
	                - 3600		(1 hour)
	                - 86400		(1 day)
	                - 604800	(7 days) -->
<refine-value idref="var_accounts_passwords_pam_faillock_unlock_time" selector="900" />

<!--	AC-11(a): Prevents further access to the system by initiating a session lock
     	after [Assignment: organization-defined time period] of inactivity or upon
     	receiving a request from a user;

	The accepted inactivity timeout values are:
	(inactivity_timeout_value)
		- 5	(minutes)
		- 10	(minutes)
		- 15	(minutes) -->
<refine-value idref="inactivity_timeout_value" selector="15" />


<!-- STATIC VARIABLES: DO NOT ALTER -->
<refine-value idref="login_banner_text" selector="usgcb_default" />
<refine-value idref="sysctl_net_ipv4_conf_all_accept_source_route_value" selector="0" />
<refine-value idref="sysctl_net_ipv4_conf_all_accept_redirects_value" selector="0" />
<refine-value idref="sysctl_net_ipv4_conf_all_log_martians_value" selector="1" />
<refine-value idref="sysctl_net_ipv4_conf_default_secure_redirects_value" selector="1" />
<refine-value idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value" selector="1" />
<refine-value idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value" selector="1" />


<!-- MAYBE
     AC-2(1) -->

<!-- AC-2(2), AC-2(3) -->
<select idref="account_temp_expire_date" selected="true" />
<select idref="account_disable_post_pw_expiration" selected="true" />

<!-- AC-2(4) -->
<select idref="audit_rules_usergroup_modification" selected="true" />
     
<!-- AC-2(7)(b) -->
<select idref="audit_sysadmin_action" selected="true" />

<!--  AC-3 -->
<select idref="sshd_use_approved_ciphers" selected="true" />
<select idref="enable_selinux_bootloader" selected="true" />
<select idref="selinux_state" selected="true" />
<select idref="selinux_policytype" selected="true" />
<select idref="service_restorecond_enabled" selected="true" />

<!-- AC-4 -->
<select idref="service_rdisc_disabled" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_send_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_secure_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_accept_source_route" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_accept_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_secure_redirects" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_rp_filter" selected="true" />
<select idref="sysctl_net_ipv4_conf_default_rp_filter" selected="true" />
<select idref="service_ip6tables_enabled" selected="true" />
<select idref="service_iptables_enabled" selected="true" />

<!-- AC-6 -->
<select idref="audit_rules_immutable" selected="true" />
<select idref="service_oddjobd_disabled" selected="true" />
<select idref="rpm_verify_permissions" selected="true" />
<select idref="file_permissions_var_log_audit" selected="true" />
<select idref="file_ownership_var_log_audit" selected="true" />
<select idref="userowner_shadow_file" selected="true" />
<select idref="groupowner_shadow_file" selected="true" />
<select idref="file_permissions_etc_shadow" selected="true" />
<select idref="file_owner_etc_group" selected="true" />
<select idref="file_groupowner_etc_group" selected="true" />
<select idref="file_permissions_etc_group" selected="true" />
<select idref="file_owner_etc_gshadow" selected="true" />
<select idref="file_groupowner_etc_gshadow" selected="true" />
<select idref="file_permissions_etc_gshadow" selected="true" />
<select idref="file_owner_etc_passwd" selected="true" />
<select idref="file_groupowner_etc_passwd" selected="true" />
<select idref="file_permissions_etc_passwd" selected="true" />
<select idref="selinux_confinement_of_daemons" selected="true" />
<select idref="permissions_within_important_dirs" selected="true" />
<select idref="file_ownership_library_dirs" selected="true" />
<select idref="file_permissions_binary_dirs" selected="true" />
<select idref="file_ownership_binary_dirs" selected="true" />
<select idref="sticky_world_writable_dirs" selected="true" />
<select idref="world_writeable_files" selected="true" />
<select idref="no_files_unowned_by_user" selected="true" />
<select idref="no_files_unowned_by_group" selected="true" />
<select idref="world_writable_files_system_ownership" selected="true" />
<select idref="umask_for_daemons" selected="true" />
<select idref="accounts_no_uid_except_zero" selected="true" />
<select idref="userowner_rsyslog_files" selected="true" />
<select idref="groupowner_rsyslog_files" selected="true" />

<!-- AC-6(2) -->
<select idref="securetty_root_login_console_only" selected="true" />
<select idref="restrict_serial_port_logins" selected="true" />
<select idref="sshd_disable_root_login" selected="true" />

<!-- AC-7(a) -->
<select idref="accounts_passwords_pam_faillock_deny" selected="true" />
<select idref="accounts_passwords_pam_faillock_interval" selected="true" />

<!-- AC-7(b) -->
<select idref="accounts_passwords_pam_faillock_unlock_time" selected="true" />

<!-- AC-8(a), AC-8(c) -->
<select idref="banner_etc_issue" selected="true" />
<select idref="gconf_gdm_enable_warning_gui_banner" selected="true" />
<select idref="gconf_gdm_set_login_banner_text" selected="true" />

<!-- AC-11(a) -->
<select idref="gconf_gnome_screensaver_idle_delay" selected="true" />
<select idref="gconf_gnome_screensaver_idle_activation_enabled" selected="true" />
<select idref="gconf_gnome_screensaver_lock_enabled" selected="true" />

<!-- AC-11(1) -->
<select idref="gconf_gnome_screensaver_mode_blank" selected="true" />

<!-- AC-17(1) -->
<select idref="service_auditd_enabled" selected="true" />
<select idref="bootloader_audit_argument" selected="true" />

<!--  AC-17(7) -->
<select idref="audit_rules_time_adjtimex" selected="true" />
<select idref="audit_rules_time_settimeofday" selected="true" />
<select idref="audit_rules_time_stime" selected="true" />
<select idref="audit_rules_time_clock_settime" selected="true" />
<select idref="audit_rules_time_watch_localtime" selected="true" />
<select idref="audit_rules_usergroup_modification" selected="true" />
<select idref="audit_rules_networkconfig_modification" selected="true" />
<select idref="audit_rules_mac_modification" selected="true" />
<select idref="audit_rules_dac_modification_chmod" selected="true" />
<select idref="audit_rules_dac_modification_chown" selected="true" />
<select idref="audit_rules_dac_modification_fchmod" selected="true" />
<select idref="audit_rules_dac_modification_fchmodat" selected="true" />
<select idref="audit_rules_dac_modification_fchown" selected="true" />
<select idref="audit_rules_dac_modification_fchownat" selected="true" />
<select idref="audit_rules_dac_modification_fremovexattr" selected="true" />
<select idref="audit_rules_dac_modification_fsetxattr" selected="true" />
<select idref="audit_rules_dac_modification_lchown" selected="true" />
<select idref="audit_rules_dac_modification_lremovexattr" selected="true" />
<select idref="audit_rules_dac_modification_lsetxattr" selected="true" />
<select idref="audit_rules_dac_modification_removexattr" selected="true" />
<select idref="audit_rules_dac_modification_setxattr" selected="true" />
<select idref="audit_rules_login_events" selected="true" />
<select idref="audit_rules_session_events" selected="true" />
<select idref="audit_rules_unsuccessful_file_modification" selected="true" />
<select idref="audit_rules_privileged_commands" selected="true" />
<select idref="audit_rules_media_export" selected="true" />
<select idref="audit_rules_file_deletion_events" selected="true" />
<select idref="audit_rules_sysadmin_actions" selected="true" />
<select idref="audit_rules_kernel_module_loading" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_log_martians" selected="true" />

<!-- AC-17(8) -->
<select idref="disable_xinetd" selected="true" />
<select idref="uninstall_xinetd" selected="true" />
<select idref="service_telnetd_disabled" selected="true" />
<select idref="uninstall_telnet_server" selected="true" />
<select idref="uninstall_rsh" selected="true" />
<select idref="service_rexec_disabled" selected="true" />
<select idref="service_rsh_disabled" selected="true" />
<select idref="service_rlogin_disabled" selected="true" />
<select idref="no_rsh_trust_files" selected="true" />
<select idref="uninstall_ypserv" selected="true" />
<select idref="disable_ypbind" selected="true" />
<select idref="service_tftp_disabled" selected="true" />
<select idref="uninstall_tftp" selected="true" />
<select idref="tftpd_uses_secure_mode" selected="true" />
<select idref="service_abrtd_disabled" selected="true" />
<select idref="service_kdump_disabled" selected="true" />
<select idref="service_netconsole_disabled" selected="true" />
<select idref="service_ntpdate_disabled" selected="true" />
<select idref="service_portreserve_disabled" selected="true" />
<select idref="service_qpidd_disabled" selected="true" />
<select idref="service_rdisc_disabled" selected="true" />
<select idref="service_rhnsd_disabled" selected="true" />
<select idref="service_saslauthd_disabled" selected="true" />
<select idref="sshd_allow_only_protocol2" selected="true" />

<!-- AC-18(a) -->
<select idref="wireless_disable_in_bios" selected="true" />
<select idref="deactivate_wireless_interfaces" selected="true" />
<select idref="service_bluetooth_disabled" selected="true" />
<select idref="kernel_module_bluetooth_disabled" selected="true" />

<!-- AC-19(a), AC-19(d), AC-19(e) -->
<select idref="mount_option_nodev_removable_partitions" selected="true" />
<select idref="mount_option_noexec_removable_partitions" selected="true" />
<select idref="mount_option_nosuid_removable_partitions" selected="true" />
<select idref="kernel_module_usb-storage_disabled" selected="true" />
<select idref="bootloader_nousb_argument" selected="true" />
<select idref="bios_disable_usb_boot" selected="true" />
<select idref="service_autofs_disabled" selected="true" />
<select idref="gconf_gnome_disable_automount" selected="true" />

<!-- AU-1(b) -->
<select idref="auditd_data_retention_num_logs" selected="true" />
<select idref="auditd_data_retention_max_log_file" selected="true" />
<select idref="auditd_data_retention_max_log_file_action" selected="true" />
<select idref="auditd_data_retention_space_left_action" selected="true" />
<select idref="auditd_data_retention_admin_space_left_action" selected="true" />
<select idref="auditd_data_retention_action_mail_acct" selected="true" />
<select idref="auditd_audispd_syslog_plugin_activated" selected="true" />

<!-- AU-3(1): THIS NEEDS FURTHER REVIEW ON ADDITIONAL
     AUDIT RECORD DETAILS -->

<!-- AU-3(2) -->
<select idref="rsyslog_send_messages_to_logserver" selected="true" />

<!-- AU-8(1) -->
<select idref="service_ntpd_enabled" selected="true" />
<select idref="ntpd_specify_remote_server" selected="true" />
<select idref="ntpd_specify_multiple_servers" selected="true" />

<!-- AU-12 -->
<select idref="service_psacct_enabled" selected="true" />

<!-- CM-3
     	At some point we should look at creating prose for this 
     	requirement, and perhaps using audit+AIDE to track
     	changes to relevant files -->

<!-- CM-6(d) -->
<select idref="package_aide_installed" selected="true" />
<select idref="disable_prelink" selected="true" />
<select idref="aide_build_database" selected="true" />
<select idref="aide_periodic_cron_checking" selected="true" />
<select idref="rpm_verify_hashes" selected="true" />

<!-- CM-7 -->
<select idref="kernel_module_ipv6_option_disabled" selected="true" />
<select idref="network_ipv6_disable_rpc" selected="true" />
<select idref="sysctl_net_ipv6_conf_default_accept_ra" selected="true" />
<select idref="sysctl_net_ipv6_conf_default_accept_redirects" selected="true" />
<select idref="network_disable_unused_interfaces" selected="true" />
<select idref="network_disable_zeroconf" selected="true" />
<select idref="network_sniffer_disabled" selected="true" />
<select idref="kernel_module_dccp_disabled" selected="true" />
<select idref="kernel_module_sctp_disabled" selected="true" />
<select idref="kernel_module_rds_disabled" selected="true" />
<select idref="kernel_module_tipc_disabled" selected="true" />
<select idref="set_iptables_default_rule" selected="true" />
<select idref="set_iptables_default_rule_forward" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_send_redirects" selected="true" />
<select idref="sysctl_ipv4_ip_forward" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_accept_source_route" selected="true" />
<select idref="sysctl_net_ipv4_conf_all_accept_redirects" selected="true" />
<select idref="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" selected="true" />
<select idref="sysctl_net_ipv4_icmp_ignore_bogus_error_responses" selected="true" />
<select idref="kernel_module_cramfs_disabled" selected="true" />
<select idref="kernel_module_freevxfs_disabled" selected="true" />
<select idref="kernel_module_jffs2_disabled" selected="true" />
<select idref="kernel_module_hfs_disabled" selected="true" />
<select idref="kernel_module_hfsplus_disabled" selected="true" />
<select idref="kernel_module_squashfs_disabled" selected="true" />
<select idref="kernel_module_udf_disabled" selected="true" />
<select idref="disable_gnome_thumbnailers" selected="true" />
<select idref="mount_option_nodev_nonroot_local_partitions" selected="true" />
<select idref="mount_option_tmp_nodev" selected="true" />
<select idref="mount_option_tmp_noexec" selected="true" />
<select idref="mount_option_tmp_nosuid" selected="true" />
<select idref="mount_option_dev_shm_nodev" selected="true" />
<select idref="mount_option_dev_shm_noexec" selected="true" />
<select idref="mount_option_dev_shm_nosuid" selected="true" />
<select idref="mount_option_var_tmp_bind" selected="true" />
<select idref="service_cups_disabled" selected="true" />
<select idref="cups_disable_browsing" selected="true" />
<select idref="cups_disable_printserver" selected="true" />
<select idref="disable_dhcp_server" selected="true" />
<select idref="uninstall_dhcp_server" selected="true" />
<select idref="disable_dhcp_client" selected="true" />
<select idref="disable_avahi" selected="true" />
<select idref="service_crond_enabled" selected="true" />
<select idref="disable_dns_server" selected="true" />
<select idref="uninstall_bind" selected="true" />
<select idref="package_openldap-servers_removed" selected="true" />
<select idref="package_sendmail_removed" selected="true" />
<select idref="service_acpid_disabled" selected="true" />
<select idref="service_atd_disabled" selected="true" />
<select idref="service_certmonger_disabled" selected="true" />
<select idref="service_cgconfig_disabled" selected="true" />
<select idref="service_cgred_disabled" selected="true" />
<select idref="service_cpuspeed_disabled" selected="true" />
<select idref="service_haldaemon_disabled" selected="true" />
<select idref="service_irqbalance_enabled" selected="true" />
<select idref="service_mdmonitor_disabled" selected="true" />
<select idref="service_messagebus_disabled" selected="true" />
<select idref="service_oddjobd_disabled" selected="true" />
<select idref="service_quota_nld_disabled" selected="true" />
<select idref="service_rhsmcertd_disabled" selected="true" />
<select idref="service_smartd_disabled" selected="true" />
<select idref="service_sysstat_disabled" selected="true" />
<select idref="disable_httpd" selected="true" />
<select idref="package_httpd_removed" selected="true" />
<select idref="disabling_vsftpd" selected="true" />
<select idref="uninstall_vsftpd" selected="true" />


<!-- REMAINING MAPPINGS
     IA-1
     IA-2
     IA-2(1)
     IA-2(5)
     IA-2(8)
     IA-3
     IA-3(1)
     IA-3(2)
     IA-3(3)
     IA-4
     IA-4(4)
     IA-5
     IA-5(1)
     IA-5(2)
     IA-5(3)
     IA-5(4)
     IA-5(6)
     IA-5(7)
     IA-5(8)
     IA-6
     IA-7
     IA-8
     IR-1
     IR-2
     IR-3
     IR-4
     IR-4(1)
     IR-4(3)
     IR-4(4)
     IR-5
     IR-6
     IR-6(1)
     IR-6(2)
     IR-7
     IR-7(1)
     IR-7(2)
     IR-8
     MA-1
     MA-2
     MA-2(1)
     MA-3
     MA-3(2)
     MA-3(3)
     MA-4
     MA-4(2)
     MA-4(3)
     MA-4(5)
     MA-4(6)
     MA-4(7)
     MA-5
     MA-5(1)
     MP-1
     MP-2
     MP-3
     MP-4
     MP-5
     MP-5(2)
     MP-6
     MP-6(2)
     MP-6(3)
     MP-6(4)
     MP-6(5)
     MP-6(6)
     PE-1
     PE-2
     PE-2(1)
     PE-2(3)
     PE-3
     PE-3(2)
     PE-3(3)
     PE-5
     PE-6
     PE-7
     PE-7(1)
     PE-8
     PE-9
     PE-10
     PE-12
     PE-13
     PE-14
     PE-15
     PE-16
     PL-1
     PL-2
     PL-2(1)
     PL-2(2)
     PL-4
     PL-5
     PL-6
     PS-1
     PS-2
     PS-3
     PS-3(1)
     PS-3(2)
     PS-3(3)
     PS-4
     PS-5
     PS-6
     PS-6(1)
     PS-6(2)
     PS-7
     PS-8
     RA-1
     RA-2
     RA-3
     RA-5
     RA-5(1)
     RA-5(2)
     RA-5(4)
     RA-5(5)
     RA-5(7)
     SA-1
     SA-2
     SA-3
     SA-4
     SA-4(6)
     SA-5
     SA-5(1)
     SA-5(2)
     SA-6
     SA-7
     SA-8
     SA-9
     SA-9(1)
     SA-10
     SA-10(1)
     SA-11
     SA-12
     SA-12(2)
     SC-1
     SC-2
     SC-2(1)
     SC-4
     SC-5
     SC-5(1)
     SC-7
     SC-7(1)
     SC-7(2)
     SC-7(3)
     SC-7(4)
     SC-7(5)
     SC-7(7)
     SC-7(8)
     SC-7(11)
     SC-7(12)
     SC-7(3)
     SC-7(14)
     SC-7(18)
     SC-8
     SC-9
     SC-9(1)
     SC-10
     SC-11
     SC-12
     SC-12(1)
     SC-13
     SC-14
     SC-15
     SC-15(1)
     SC-15(2)
     SC-15(3)
     SC-17
     SC-18
     SC-18(1)
     SC-18(2)
     SC-18(3)
     SC-18(4)
     SC-19
     SC-20
     SC-20(1)
     DC-21
     SC-21(1)
     SC-22
     SC-23
     SC-23(1)
     SC-23(2)
     SC-23(3)
     SC-23(4)
     SC-24
     SC-28
     SI-1
     SC-2
     SC-2(3)
     SC-2(4)
     SI-3
     SI-3(1)
     SC-3(2)
     SC-3(3)
     SI-4
     SI-4(1)
     SI-4(2)
     SI-4(4)
     SI-4(5)
     SI-4(6)
     SI-4(7)
     SI-4(8)
     SI-4(9)
     SI-4(11)
     SI-4(12)
     SI-4(14)
     SI-4(15)
     SI-4(16)
     SI-4(17)
     SI-5
     SI-5(1)
     SI-6
     SI-6(1)
     SI-6(3)
     SI-8
     SI-8(1)
     SI-8(2)
     SI-9
     SI-11
     SI-12
     -->


</Profile>
