diff --git a/.gitignore b/.gitignore index 8ecb471..8d1d1d0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2 -SOURCES/scap-security-guide-0.1.54.tar.bz2 +SOURCES/scap-security-guide-0.1.57.tar.bz2 diff --git a/.scap-security-guide.metadata b/.scap-security-guide.metadata index 517ac64..3afce51 100644 --- a/.scap-security-guide.metadata +++ b/.scap-security-guide.metadata @@ -1,2 +1,2 @@ b22b45d29ad5a97020516230a6ef3140a91d050a SOURCES/scap-security-guide-0.1.52-2.el7_9-rhel6.tar.bz2 -9c53524d1f6741913b19394fad9216f25f3ae05d SOURCES/scap-security-guide-0.1.54.tar.bz2 +d78bdc956df4301c3b3bbb2f9f24d809d7b1d08c SOURCES/scap-security-guide-0.1.57.tar.bz2 diff --git a/SOURCES/0001-Add-AlmaLinux-8-support.patch b/SOURCES/0001-Add-AlmaLinux-8-support.patch index ed39078..6f44d91 100644 --- a/SOURCES/0001-Add-AlmaLinux-8-support.patch +++ b/SOURCES/0001-Add-AlmaLinux-8-support.patch @@ -1,8 +1,8 @@ diff --git a/CMakeLists.txt b/CMakeLists.txt -index 6995944a..6609ed13 100644 +index 19424601..e1d5ca01 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt -@@ -60,6 +60,7 @@ option(SSG_PRODUCT_DEFAULT "If enabled, all default release products will be bui +@@ -64,6 +64,7 @@ option(SSG_PRODUCT_DEFAULT "If enabled, all default release products will be bui # Products to build content for. These generally correspond to directories in # the root of this project. Note that the example product is always disabled # unless explicitly asked for. @@ -10,7 +10,7 @@ index 6995944a..6609ed13 100644 option(SSG_PRODUCT_CHROMIUM "If enabled, the Chromium SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_DEBIAN9 "If enabled, the Debian 9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) option(SSG_PRODUCT_DEBIAN10 "If enabled, the Debian 10 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) -@@ -240,6 +241,7 @@ endif() +@@ -259,6 +260,7 @@ endif() message(STATUS " ") message(STATUS "Products:") @@ -18,6343 +18,21 @@ index 6995944a..6609ed13 100644 message(STATUS "Chromium: ${SSG_PRODUCT_CHROMIUM}") message(STATUS "Debian 9: ${SSG_PRODUCT_DEBIAN9}") message(STATUS "Debian 10: ${SSG_PRODUCT_DEBIAN10}") -@@ -305,6 +307,9 @@ ssg_build_bash_remediation_functions() +@@ -325,6 +327,9 @@ ssg_build_bash_remediation_functions() ssg_build_man_page() +if (SSG_PRODUCT_ALMALINUX8) -+ add_subdirectory("almalinux8") ++ add_subdirectory("products/almalinux8" "almalinux8") +endif() if (SSG_PRODUCT_CHROMIUM) - add_subdirectory("chromium") + add_subdirectory("products/chromium" "chromium") endif() -diff --git a/almalinux8/CMakeLists.txt b/almalinux8/CMakeLists.txt -new file mode 100644 -index 00000000..60960dd2 ---- /dev/null -+++ b/almalinux8/CMakeLists.txt -@@ -0,0 +1,27 @@ -+# Sometimes our users will try to do: "cd almalinux8; cmake ." That needs to error in a nice way. -+if ("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") -+ message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the developer_guide.adoc for more details!") -+endif() -+ -+set(PRODUCT "almalinux8") -+set(DISA_SRG_TYPE "os") -+ -+ssg_build_product(${PRODUCT}) -+ -+ssg_build_html_table_by_ref(${PRODUCT} "nist") -+ssg_build_html_table_by_ref(${PRODUCT} "cui") -+# No CIS yet for AlmaLinux -+# ssg_build_html_table_by_ref(${PRODUCT} "cis") -+ssg_build_html_table_by_ref(${PRODUCT} "pcidss") -+ssg_build_html_table_by_ref(${PRODUCT} "anssi") -+ -+ssg_build_html_nistrefs_table(${PRODUCT} "ospp") -+ssg_build_html_nistrefs_table(${PRODUCT} "stig") -+ -+ssg_build_html_cce_table(${PRODUCT}) -+ -+ssg_build_html_srgmap_tables(${PRODUCT} "stig" ${DISA_SRG_TYPE}) -+ -+ssg_build_html_stig_tables(${PRODUCT} "stig") -+ -+#ssg_build_html_stig_tables(${PRODUCT} "ospp") -diff --git a/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_enhanced-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_enhanced-ks.cfg -new file mode 100644 -index 00000000..cda3e1ac ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_enhanced-ks.cfg -@@ -0,0 +1,163 @@ -+# SCAP Security Guide ANSSI BP-028 (enhanced) profile kickstart for AlmaLinux 8 -+# Version: 0.0.1 -+# Date: 2021-01-28 -+# -+# Based on: -+# https://pykickstart.readthedocs.io/en/latest/ -+# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --bootproto dhcp --noipv6 -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Plaintext password is: password -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" -+part pv.01 --grow --size=1 -+ -+# Create a Logical Volume Management (LVM) group (optional) -+volgroup VolGroup --pesize=4096 pv.01 -+ -+# Create particular logical volumes (optional) -+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow -+# Ensure /usr Located On Separate Partition -+logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev" -+# Ensure /opt Located On Separate Partition -+logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" -+# Ensure /srv Located On Separate Partition -+logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" -+# Ensure /home Located On Separate Partition -+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# Ensure /tmp Located On Separate Partition -+logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/tmp Located On Separate Partition -+logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var Located On Separate Partition -+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" -+# Ensure /var/log Located On Separate Partition -+logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/log/audit Located On Separate Partition -+logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" -+logvol swap --name=swap --vgname=VolGroup --size=2016 -+ -+# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) -+# content - security policies - on the installed system.This add-on has been enabled by default -+# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this -+# functionality will automatically be installed. However, by default, no policies are enforced, -+# meaning that no checks are performed during or after installation unless specifically configured. -+# -+# Important -+# Applying a security policy is not necessary on all systems. This screen should only be used -+# when a specific policy is mandated by your organization rules or government regulations. -+# Unlike most other commands, this add-on does not accept regular options, but uses key-value -+# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. -+# Values can be optionally enclosed in single quotes (') or double quotes ("). -+# -+# The following keys are recognized by the add-on: -+# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. -+# - If the content-type is scap-security-guide, the add-on will use content provided by the -+# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. -+# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. -+# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. -+# xccdf-id - ID of the benchmark you want to use. -+# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. -+# profile - ID of the profile to be applied. Use default to apply the default profile. -+# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. -+# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. -+# -+# The following is an example %addon org_fedora_oscap section which uses content from the -+# scap-security-guide on the installation media: -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_intermediary-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_intermediary-ks.cfg -new file mode 100644 -index 00000000..54abf703 ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_intermediary-ks.cfg -@@ -0,0 +1,163 @@ -+# SCAP Security Guide ANSSI BP-028 (intermediary) profile kickstart for AlmaLinux 8 -+# Version: 0.0.1 -+# Date: 2021-01-28 -+# -+# Based on: -+# https://pykickstart.readthedocs.io/en/latest/ -+# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --bootproto dhcp --noipv6 -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Plaintext password is: password -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+bootloader --location=mbr -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" -+part pv.01 --grow --size=1 -+ -+# Create a Logical Volume Management (LVM) group (optional) -+volgroup VolGroup --pesize=4096 pv.01 -+ -+# Create particular logical volumes (optional) -+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow -+# Ensure /usr Located On Separate Partition -+logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev" -+# Ensure /opt Located On Separate Partition -+logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" -+# Ensure /srv Located On Separate Partition -+logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" -+# Ensure /home Located On Separate Partition -+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# Ensure /tmp Located On Separate Partition -+logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/tmp Located On Separate Partition -+logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var Located On Separate Partition -+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" -+# Ensure /var/log Located On Separate Partition -+logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/log/audit Located On Separate Partition -+logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" -+logvol swap --name=swap --vgname=VolGroup --size=2016 -+ -+# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) -+# content - security policies - on the installed system.This add-on has been enabled by default -+# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this -+# functionality will automatically be installed. However, by default, no policies are enforced, -+# meaning that no checks are performed during or after installation unless specifically configured. -+# -+# Important -+# Applying a security policy is not necessary on all systems. This screen should only be used -+# when a specific policy is mandated by your organization rules or government regulations. -+# Unlike most other commands, this add-on does not accept regular options, but uses key-value -+# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. -+# Values can be optionally enclosed in single quotes (') or double quotes ("). -+# -+# The following keys are recognized by the add-on: -+# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. -+# - If the content-type is scap-security-guide, the add-on will use content provided by the -+# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. -+# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. -+# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. -+# xccdf-id - ID of the benchmark you want to use. -+# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. -+# profile - ID of the profile to be applied. Use default to apply the default profile. -+# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. -+# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. -+# -+# The following is an example %addon org_fedora_oscap section which uses content from the -+# scap-security-guide on the installation media: -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_minimal-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_minimal-ks.cfg -new file mode 100644 -index 00000000..2a12b048 ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_minimal-ks.cfg -@@ -0,0 +1,127 @@ -+# SCAP Security Guide ANSSI BP-028 (minimal) profile kickstart for AlmaLinux 8 -+# Version: 0.0.1 -+# Date: 2021-01-28 -+# -+# Based on: -+# https://pykickstart.readthedocs.io/en/latest/ -+# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --bootproto dhcp -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Plaintext password is: password -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+bootloader --location=mbr -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+autopart -+ -+# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) -+# content - security policies - on the installed system.This add-on has been enabled by default -+# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this -+# functionality will automatically be installed. However, by default, no policies are enforced, -+# meaning that no checks are performed during or after installation unless specifically configured. -+# -+# Important -+# Applying a security policy is not necessary on all systems. This screen should only be used -+# when a specific policy is mandated by your organization rules or government regulations. -+# Unlike most other commands, this add-on does not accept regular options, but uses key-value -+# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. -+# Values can be optionally enclosed in single quotes (') or double quotes ("). -+# -+# The following keys are recognized by the add-on: -+# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. -+# - If the content-type is scap-security-guide, the add-on will use content provided by the -+# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. -+# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. -+# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. -+# xccdf-id - ID of the benchmark you want to use. -+# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. -+# profile - ID of the profile to be applied. Use default to apply the default profile. -+# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. -+# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. -+# -+# The following is an example %addon org_fedora_oscap section which uses content from the -+# scap-security-guide on the installation media: -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_anssi_bp28_minimal -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-cis-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-cis-ks.cfg -new file mode 100644 -index 00000000..0073c5c1 ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-cis-ks.cfg -@@ -0,0 +1,144 @@ -+# SCAP Security Guide CIS profile kickstart for AlmaLinux 8 -+# Version: 0.0.1 -+# Date: 2020-03-30 -+# -+# Based on: -+# http://fedoraproject.org/wiki/Anaconda/Kickstart -+ -+# Install a fresh new system (optional) -+install -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+ -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --device eth0 --bootproto dhcp --noipv6 -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create -+# encrypted password form for different plaintext password -+rootpw --iscrypted $6$rhel6usgcb$aS6oPGXcPKp3OtFArSrhRwu6sN8q2.yEGY7AIwDOQd23YCtiz9c5mXbid1BzX9bmXTEZi.hCzTEXFosVBI5ng0 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set up the authentication options for the system (required) -+# sssd profile sets sha512 to hash passwords -+# passwords are shadowed by default -+# See the manual page for authselect-profile for a complete list of possible options. -+authselect select sssd -+ -+# State of SELinux on the installed system (optional) -+# Defaults to enforcing -+selinux --enforcing -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Plaintext password is: password -+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create -+# encrypted password form for different plaintext password -+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$rhel6usgcb$kOzIfC4zLbuo3ECp1er99NRYikN419wxYMmons8Vm/37Qtg0T8aB9dKxHwqapz8wWAFuVkuI/UJqQBU92bA5C0 -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+part /boot --fstype=xfs --size=512 -+part pv.01 --grow --size=1 -+ -+# Create a Logical Volume Management (LVM) group (optional) -+volgroup VolGroup --pesize=4096 pv.01 -+ -+# Create particular logical volumes (optional) -+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow -+# Ensure /home Located On Separate Partition -+logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# Ensure /tmp Located On Separate Partition -+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid" -+# Ensure /var/tmp Located On Separate Partition -+logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var Located On Separate Partition -+logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048 -+# Ensure /var/log Located On Separate Partition -+logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 -+# Ensure /var/log/audit Located On Separate Partition -+logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512 -+logvol swap --name=lv_swap --vgname=VolGroup --size=2016 -+ -+ -+# Harden installation with CIS profile -+# For more details and configuration options see -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_cis -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-cui-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-cui-ks.cfg -new file mode 100644 -index 00000000..0b08a08b ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-cui-ks.cfg -@@ -0,0 +1,167 @@ -+# SCAP Security Guide CUI profile kickstart for AlmaLinux 8 -+# -+# Based on: -+# http://fedoraproject.org/wiki/Anaconda/Kickstart -+# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -+ -+# Install a fresh new system (optional) -+install -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --bootproto dhcp -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set up the authentication options for the system (required) -+# --enableshadow enable shadowed passwords by default -+# --passalgo hash / crypt algorithm for new passwords -+# See the manual page for authconfig for a complete list of possible options. -+authconfig --enableshadow --passalgo=sha512 -+ -+# State of SELinux on the installed system (optional) -+# Defaults to enforcing -+selinux --enforcing -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+part /boot --fstype=xfs --size=512 -+part pv.01 --grow --size=1 -+ -+# Create a Logical Volume Management (LVM) group (optional) -+volgroup VolGroup --pesize=4096 pv.01 -+ -+# Create particular logical volumes (optional) -+logvol / --fstype=xfs --name=root --vgname=VolGroup --size=11264 --grow -+# Ensure /home Located On Separate Partition -+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# Ensure /tmp Located On Separate Partition -+logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/tmp Located On Separate Partition -+logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var Located On Separate Partition -+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev" -+# Ensure /var/log Located On Separate Partition -+logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/log/audit Located On Separate Partition -+logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" -+logvol swap --name=swap --vgname=VolGroup --size=2016 -+ -+# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) -+# content - security policies - on the installed system.This add-on has been enabled by default -+# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this -+# functionality will automatically be installed. However, by default, no policies are enforced, -+# meaning that no checks are performed during or after installation unless specifically configured. -+# -+# Important -+# Applying a security policy is not necessary on all systems. This screen should only be used -+# when a specific policy is mandated by your organization rules or government regulations. -+# Unlike most other commands, this add-on does not accept regular options, but uses key-value -+# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. -+# Values can be optionally enclosed in single quotes (') or double quotes ("). -+# -+# The following keys are recognized by the add-on: -+# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. -+# - If the content-type is scap-security-guide, the add-on will use content provided by the -+# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. -+# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. -+# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. -+# xccdf-id - ID of the benchmark you want to use. -+# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. -+# profile - ID of the profile to be applied. Use default to apply the default profile. -+# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. -+# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. -+# -+# The following is an example %addon org_fedora_oscap section which uses content from the -+# scap-security-guide on the installation media: -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_cui -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-e8-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-e8-ks.cfg -new file mode 100644 -index 00000000..b11014a5 ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-e8-ks.cfg -@@ -0,0 +1,123 @@ -+# SCAP Security Guide Essential Eight profile kickstart for AlmaLinux 8 -+# Version: 0.0.1 -+# Date: 2019-11-13 -+# -+# Based on: -+# http://fedoraproject.org/wiki/Anaconda/Kickstart -+ -+# Install a fresh new system (optional) -+install -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+ -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --device eth0 --bootproto dhcp --noipv6 -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create -+# encrypted password form for different plaintext password -+rootpw --iscrypted $6$rhel6usgcb$aS6oPGXcPKp3OtFArSrhRwu6sN8q2.yEGY7AIwDOQd23YCtiz9c5mXbid1BzX9bmXTEZi.hCzTEXFosVBI5ng0 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set up the authentication options for the system (required) -+# sssd profile sets sha512 to hash passwords -+# passwords are shadowed by default -+# See the manual page for authselect-profile for a complete list of possible options. -+authselect select sssd -+ -+# State of SELinux on the installed system (optional) -+# Defaults to enforcing -+selinux --enforcing -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Plaintext password is: password -+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create -+# encrypted password form for different plaintext password -+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$rhel6usgcb$kOzIfC4zLbuo3ECp1er99NRYikN419wxYMmons8Vm/37Qtg0T8aB9dKxHwqapz8wWAFuVkuI/UJqQBU92bA5C0 -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+autopart -+ -+# Harden installation with Essential Eight profile -+# For more details and configuration options see -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_e8 -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-hipaa-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-hipaa-ks.cfg -new file mode 100644 -index 00000000..45d4701d ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-hipaa-ks.cfg -@@ -0,0 +1,123 @@ -+# SCAP Security Guide HIPAA profile kickstart for AlmaLinux 8 -+# Version: 0.0.1 -+# Date: 2020-05-25 -+# -+# Based on: -+# http://fedoraproject.org/wiki/Anaconda/Kickstart -+ -+# Install a fresh new system (optional) -+install -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+ -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --device eth0 --bootproto dhcp --noipv6 -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create -+# encrypted password form for different plaintext password -+rootpw --iscrypted $6$rhel6usgcb$aS6oPGXcPKp3OtFArSrhRwu6sN8q2.yEGY7AIwDOQd23YCtiz9c5mXbid1BzX9bmXTEZi.hCzTEXFosVBI5ng0 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set up the authentication options for the system (required) -+# sssd profile sets sha512 to hash passwords -+# passwords are shadowed by default -+# See the manual page for authselect-profile for a complete list of possible options. -+authselect select sssd -+ -+# State of SELinux on the installed system (optional) -+# Defaults to enforcing -+selinux --enforcing -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Plaintext password is: password -+# Refer to e.g. http://fedoraproject.org/wiki/Anaconda/Kickstart#rootpw to see how to create -+# encrypted password form for different plaintext password -+bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$rhel6usgcb$kOzIfC4zLbuo3ECp1er99NRYikN419wxYMmons8Vm/37Qtg0T8aB9dKxHwqapz8wWAFuVkuI/UJqQBU92bA5C0 -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+autopart -+ -+# Harden installation with HIPAA profile -+# For more details and configuration options see -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_hipaa -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-ospp-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-ospp-ks.cfg -new file mode 100644 -index 00000000..42f01004 ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-ospp-ks.cfg -@@ -0,0 +1,167 @@ -+# SCAP Security Guide OSPP profile kickstart for AlmaLinux 8 -+# -+# Based on: -+# http://fedoraproject.org/wiki/Anaconda/Kickstart -+# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -+ -+# Install a fresh new system (optional) -+install -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --bootproto dhcp -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set up the authentication options for the system (required) -+# --enableshadow enable shadowed passwords by default -+# --passalgo hash / crypt algorithm for new passwords -+# See the manual page for authconfig for a complete list of possible options. -+authconfig --enableshadow --passalgo=sha512 -+ -+# State of SELinux on the installed system (optional) -+# Defaults to enforcing -+selinux --enforcing -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+part /boot --fstype=xfs --size=512 -+part pv.01 --grow --size=1 -+ -+# Create a Logical Volume Management (LVM) group (optional) -+volgroup VolGroup --pesize=4096 pv.01 -+ -+# Create particular logical volumes (optional) -+logvol / --fstype=xfs --name=root --vgname=VolGroup --size=11264 --grow -+# Ensure /home Located On Separate Partition -+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# Ensure /tmp Located On Separate Partition -+logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/tmp Located On Separate Partition -+logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var Located On Separate Partition -+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev" -+# Ensure /var/log Located On Separate Partition -+logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/log/audit Located On Separate Partition -+logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" -+logvol swap --name=swap --vgname=VolGroup --size=2016 -+ -+# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) -+# content - security policies - on the installed system.This add-on has been enabled by default -+# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this -+# functionality will automatically be installed. However, by default, no policies are enforced, -+# meaning that no checks are performed during or after installation unless specifically configured. -+# -+# Important -+# Applying a security policy is not necessary on all systems. This screen should only be used -+# when a specific policy is mandated by your organization rules or government regulations. -+# Unlike most other commands, this add-on does not accept regular options, but uses key-value -+# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. -+# Values can be optionally enclosed in single quotes (') or double quotes ("). -+# -+# The following keys are recognized by the add-on: -+# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. -+# - If the content-type is scap-security-guide, the add-on will use content provided by the -+# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. -+# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. -+# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. -+# xccdf-id - ID of the benchmark you want to use. -+# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. -+# profile - ID of the profile to be applied. Use default to apply the default profile. -+# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. -+# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. -+# -+# The following is an example %addon org_fedora_oscap section which uses content from the -+# scap-security-guide on the installation media: -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_ospp -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-pci-dss-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-pci-dss-ks.cfg -new file mode 100644 -index 00000000..5c47d1ce ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-pci-dss-ks.cfg -@@ -0,0 +1,157 @@ -+# SCAP Security Guide PCI-DSS profile kickstart for AlmaLinux 8 -+# -+# Based on: -+# http://fedoraproject.org/wiki/Anaconda/Kickstart -+# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -+ -+# Install a fresh new system (optional) -+install -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+ -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+network --onboot yes --bootproto dhcp --noipv6 -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set up the authentication options for the system (required) -+# --enableshadow enable shadowed passwords by default -+# --passalgo hash / crypt algorithm for new passwords -+# See the manual page for authconfig for a complete list of possible options. -+authconfig --enableshadow --passalgo=sha512 -+ -+# State of SELinux on the installed system (optional) -+# Defaults to enforcing -+selinux --enforcing -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Plaintext password is: password -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+# -+# PASSWORD TEMPORARILY DISABLED -+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" -+#bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$rhel6usgcb$kOzIfC4zLbuo3ECp1er99NRYikN419wxYMmons8Vm/37Qtg0T8aB9dKxHwqapz8wWAFuVkuI/UJqQBU92bA5C0 -+ -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+part /boot --fstype=xfs --size=512 -+part pv.01 --grow --size=1 -+ -+# Create a Logical Volume Management (LVM) group (optional) -+volgroup VolGroup --pesize=4096 pv.01 -+ -+# Create particular logical volumes (optional) -+logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=12288 --grow -+# CCE-26557-9: Ensure /home Located On Separate Partition -+logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# CCE-26435-8: Ensure /tmp Located On Separate Partition -+logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid" -+# CCE-26639-5: Ensure /var Located On Separate Partition -+logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=2048 --fsoptions="nodev" -+# CCE-26215-4: Ensure /var/log Located On Separate Partition -+logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# CCE-26436-6: Ensure /var/log/audit Located On Separate Partition -+logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512 --fsoptions="nodev" -+logvol swap --name=lv_swap --vgname=VolGroup --size=2016 -+ -+# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) -+# content - security policies - on the installed system.This add-on has been enabled by default -+# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this -+# functionality will automatically be installed. However, by default, no policies are enforced, -+# meaning that no checks are performed during or after installation unless specifically configured. -+# -+# Important -+# Applying a security policy is not necessary on all systems. This screen should only be used -+# when a specific policy is mandated by your organization rules or government regulations. -+# Unlike most other commands, this add-on does not accept regular options, but uses key-value -+# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. -+# Values can be optionally enclosed in single quotes (') or double quotes ("). -+# -+# The following keys are recognized by the add-on: -+# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. -+# - If the content-type is scap-security-guide, the add-on will use content provided by the -+# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. -+# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. -+# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. -+# xccdf-id - ID of the benchmark you want to use. -+# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. -+# profile - ID of the profile to be applied. Use default to apply the default profile. -+# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. -+# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. -+# -+# The following is an example %addon org_fedora_oscap section which uses content from the -+# scap-security-guide on the installation media: -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_pci-dss -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/kickstart/ssg-almalinux8-stig-ks.cfg b/almalinux8/kickstart/ssg-almalinux8-stig-ks.cfg -new file mode 100644 -index 00000000..b8c16118 ---- /dev/null -+++ b/almalinux8/kickstart/ssg-almalinux8-stig-ks.cfg -@@ -0,0 +1,167 @@ -+# SCAP Security Guide STIG profile kickstart for AlmaLinux 8 -+# -+# Based on: -+# http://fedoraproject.org/wiki/Anaconda/Kickstart -+# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -+ -+# Install a fresh new system (optional) -+install -+ -+# Specify installation method to use for installation -+# To use a different one comment out the 'url' one below, update -+# the selected choice with proper options & un-comment it -+# -+# Install from an installation tree on a remote server via FTP or HTTP: -+# --url the URL to install from -+# -+# Example: -+# -+# url --url=http://192.168.122.1/image -+# -+# Modify concrete URL in the above example appropriately to reflect the actual -+# environment machine is to be installed in -+# -+# Other possible / supported installation methods: -+# * install from the first CD-ROM/DVD drive on the system: -+# -+# cdrom -+# -+# * install from a directory of ISO images on a local drive: -+# -+# harddrive --partition=hdb2 --dir=/tmp/install-tree -+# -+# * install from provided NFS server: -+# -+# nfs --server= --dir= [--opts=] -+# -+# Set language to use during installation and the default language to use on the installed system (required) -+lang en_US.UTF-8 -+ -+# Set system keyboard type / layout (required) -+keyboard us -+ -+# Configure network information for target system and activate network devices in the installer environment (optional) -+# --onboot enable device at a boot time -+# --device device to be activated and / or configured with the network command -+# --bootproto method to obtain networking configuration for device (default dhcp) -+# --noipv6 disable IPv6 on this device -+# -+# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, -+# "--bootproto=static" must be used. For example: -+# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 -+# -+network --onboot yes --bootproto dhcp -+ -+# Set the system's root password (required) -+# Plaintext password is: server -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -+ -+# The selected profile will restrict root login -+# Add a user that can login and escalate privileges -+# Plaintext password is: admin123 -+user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -+ -+# Configure firewall settings for the system (optional) -+# --enabled reject incoming connections that are not in response to outbound requests -+# --ssh allow sshd service through the firewall -+firewall --enabled --ssh -+ -+# Set up the authentication options for the system (required) -+# --enableshadow enable shadowed passwords by default -+# --passalgo hash / crypt algorithm for new passwords -+# See the manual page for authconfig for a complete list of possible options. -+authconfig --enableshadow --passalgo=sha512 -+ -+# State of SELinux on the installed system (optional) -+# Defaults to enforcing -+selinux --enforcing -+ -+# Set the system time zone (required) -+timezone --utc America/New_York -+ -+# Specify how the bootloader should be installed (required) -+# Refer to e.g. -+# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw -+# to see how to create encrypted password form for different plaintext password -+bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" -+ -+# Initialize (format) all disks (optional) -+zerombr -+ -+# The following partition layout scheme assumes disk of size 20GB or larger -+# Modify size of partitions appropriately to reflect actual machine's hardware -+# -+# Remove Linux partitions from the system prior to creating new ones (optional) -+# --linux erase all Linux partitions -+# --initlabel initialize the disk label to the default based on the underlying architecture -+clearpart --linux --initlabel -+ -+# Create primary system partitions (required for installs) -+part /boot --fstype=xfs --size=512 -+part pv.01 --grow --size=1 -+ -+# Create a Logical Volume Management (LVM) group (optional) -+volgroup VolGroup --pesize=4096 pv.01 -+ -+# Create particular logical volumes (optional) -+logvol / --fstype=xfs --name=root --vgname=VolGroup --size=11264 --grow -+# Ensure /home Located On Separate Partition -+logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" -+# Ensure /tmp Located On Separate Partition -+logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/tmp Located On Separate Partition -+logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var Located On Separate Partition -+logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=2048 --fsoptions="nodev" -+# Ensure /var/log Located On Separate Partition -+logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" -+# Ensure /var/log/audit Located On Separate Partition -+logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" -+logvol swap --name=swap --vgname=VolGroup --size=2016 -+ -+# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) -+# content - security policies - on the installed system.This add-on has been enabled by default -+# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this -+# functionality will automatically be installed. However, by default, no policies are enforced, -+# meaning that no checks are performed during or after installation unless specifically configured. -+# -+# Important -+# Applying a security policy is not necessary on all systems. This screen should only be used -+# when a specific policy is mandated by your organization rules or government regulations. -+# Unlike most other commands, this add-on does not accept regular options, but uses key-value -+# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. -+# Values can be optionally enclosed in single quotes (') or double quotes ("). -+# -+# The following keys are recognized by the add-on: -+# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. -+# - If the content-type is scap-security-guide, the add-on will use content provided by the -+# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. -+# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. -+# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. -+# xccdf-id - ID of the benchmark you want to use. -+# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. -+# profile - ID of the profile to be applied. Use default to apply the default profile. -+# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. -+# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. -+# -+# The following is an example %addon org_fedora_oscap section which uses content from the -+# scap-security-guide on the installation media: -+%addon org_fedora_oscap -+ content-type = scap-security-guide -+ profile = xccdf_org.ssgproject.content_profile_stig -+%end -+ -+# Packages selection (%packages section is required) -+%packages -+ -+# Require @Base -+@Base -+ -+%end # End of %packages section -+ -+# Reboot after the installation is complete (optional) -+# --eject attempt to eject CD or DVD media before rebooting -+reboot --eject -diff --git a/almalinux8/overlays/srg_support.xml b/almalinux8/overlays/srg_support.xml -new file mode 100644 -index 00000000..0bb5a068 ---- /dev/null -+++ b/almalinux8/overlays/srg_support.xml -@@ -0,0 +1,173 @@ -+ -diff --git a/almalinux8/overlays/stig_overlay.xml b/almalinux8/overlays/stig_overlay.xml -new file mode 100644 -index 00000000..e3f25757 ---- /dev/null -+++ b/almalinux8/overlays/stig_overlay.xml -@@ -0,0 +1,1367 @@ -+ -+ -+ -+ -+ -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010010" disa="366" severity="medium"> -+ <VMSinfo VKey="230222" SVKey="230222r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 vendor packaged system security patches and updates must be installed and up to date."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010020" disa="68" severity="high"> -+ <VMSinfo VKey="230223" SVKey="230223r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010030" disa="1199" severity="medium"> -+ <VMSinfo VKey="230224" SVKey="230224r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010040" disa="48" severity="medium"> -+ <VMSinfo VKey="230225" SVKey="230225r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a ssh logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010050" disa="48" severity="medium"> -+ <VMSinfo VKey="230226" SVKey="230226r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010060" disa="48" severity="medium"> -+ <VMSinfo VKey="230227" SVKey="230227r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010070" disa="67" severity="medium"> -+ <VMSinfo VKey="230228" SVKey="230228r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 remote access methods must be monitored."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010090" disa="185" severity="medium"> -+ <VMSinfo VKey="230229" SVKey="230229r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010100" disa="186" severity="medium"> -+ <VMSinfo VKey="230230" SVKey="230230r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8, for certificate-based authentication, must enforce authorized access to the corresponding private key."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010110" disa="196" severity="medium"> -+ <VMSinfo VKey="230231" SVKey="230231r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010120" disa="196" severity="medium"> -+ <VMSinfo VKey="230232" SVKey="230232r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010130" disa="196" severity="medium"> -+ <VMSinfo VKey="230233" SVKey="230233r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all created passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010140" disa="213" severity="high"> -+ <VMSinfo VKey="230234" SVKey="230234r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 operating systems booted with United Extensible Firmware Interface (UEFI) implemented must require authentication upon booting into single-user mode and maintenance."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010150" disa="213" severity="high"> -+ <VMSinfo VKey="230235" SVKey="230235r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010151" disa="213" severity="medium"> -+ <VMSinfo VKey="230236" SVKey="230236r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 operating systems must require authentication upon booting into emergency or rescue modes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010160" disa="803" severity="medium"> -+ <VMSinfo VKey="230237" SVKey="230237r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 pam_unix.so module must use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010161" disa="803" severity="medium"> -+ <VMSinfo VKey="230238" SVKey="230238r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent system daemons from using Kerberos for authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010162" disa="803" severity="medium"> -+ <VMSinfo VKey="230239" SVKey="230239r5997" VRelease="r599732"/> -+ <title text="The krb5-workstation package must not be installed on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010170" disa="1084" severity="medium"> -+ <VMSinfo VKey="230240" SVKey="230240r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must use a Linux Security Module configured to enforce limits on system services."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010171" disa="1084" severity="low"> -+ <VMSinfo VKey="230241" SVKey="230241r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must have policycoreutils package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010180" disa="1090" severity="medium"> -+ <VMSinfo VKey="230242" SVKey="230242r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 public directories must be owned by root or a system account to prevent unauthorized and unintended information transferred via shared system resources."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010190" disa="1090" severity="medium"> -+ <VMSinfo VKey="230243" SVKey="230243r5997" VRelease="r599732"/> -+ <title text="A sticky bit must be set on all AlmaLinux 8 public directories to prevent unauthorized and unintended information transferred via shared system resources."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010200" disa="1133" severity="medium"> -+ <VMSinfo VKey="230244" SVKey="230244r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission requirements."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010210" disa="1314" severity="medium"> -+ <VMSinfo VKey="230245" SVKey="230245r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 /var/log/messages file must have mode 0640 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010220" disa="1314" severity="medium"> -+ <VMSinfo VKey="230246" SVKey="230246r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 /var/log/messages file must be owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010230" disa="1314" severity="medium"> -+ <VMSinfo VKey="230247" SVKey="230247r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 /var/log/messages file must be group-owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010240" disa="1314" severity="medium"> -+ <VMSinfo VKey="230248" SVKey="230248r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 /var/log directory must have mode 0755 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010250" disa="1314" severity="medium"> -+ <VMSinfo VKey="230249" SVKey="230249r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 /var/log directory must be owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010260" disa="1314" severity="medium"> -+ <VMSinfo VKey="230250" SVKey="230250r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 /var/log directory must be group-owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010290" disa="1453" severity="medium"> -+ <VMSinfo VKey="230251" SVKey="230251r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH daemon must be configured to use only Message Authentication Codes (MACs) employing FIPS 140-2 validated cryptographic hash algorithms."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010291" disa="1453" severity="medium"> -+ <VMSinfo VKey="230252" SVKey="230252r5997" VRelease="r599778"/> -+ <title text="The AlmaLinux 8 operating system must implement DoD-approved encryption to protect the confidentiality of SSH connections."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010292" disa="366" severity="low"> -+ <VMSinfo VKey="230253" SVKey="230253r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must ensure the SSH server uses strong entropy."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010293" disa="1453" severity="medium"> -+ <VMSinfo VKey="230254" SVKey="230254r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 operating system must implement DoD-approved encryption in the OpenSSL package."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010294" disa="1453" severity="medium"> -+ <VMSinfo VKey="230255" SVKey="230255r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 operating system must implement DoD-approved TLS encryption in the OpenSSL package."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010295" disa="1453" severity="medium"> -+ <VMSinfo VKey="230256" SVKey="230256r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 operating system must implement DoD-approved TLS encryption in the GnuTLS package."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010300" disa="1499" severity="medium"> -+ <VMSinfo VKey="230257" SVKey="230257r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 system commands must have mode 0755 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010310" disa="1499" severity="medium"> -+ <VMSinfo VKey="230258" SVKey="230258r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 system commands must be owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010320" disa="1499" severity="medium"> -+ <VMSinfo VKey="230259" SVKey="230259r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 system commands must be group-owned by root or a system account."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010330" disa="1499" severity="medium"> -+ <VMSinfo VKey="230260" SVKey="230260r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 library files must have mode 0755 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010340" disa="1499" severity="medium"> -+ <VMSinfo VKey="230261" SVKey="230261r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 library files must be owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010350" disa="1499" severity="medium"> -+ <VMSinfo VKey="230262" SVKey="230262r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 library files must be group-owned by root or a system account."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010360" disa="1744" severity="medium"> -+ <VMSinfo VKey="230263" SVKey="230263r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered within an organizationally defined frequency."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010370" disa="1749" severity="high"> -+ <VMSinfo VKey="230264" SVKey="230264r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010371" disa="1749" severity="high"> -+ <VMSinfo VKey="230265" SVKey="230265r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010372" disa="1749" severity="medium"> -+ <VMSinfo VKey="230266" SVKey="230266r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent the loading of a new kernel for later execution."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010373" disa="2165" severity="medium"> -+ <VMSinfo VKey="230267" SVKey="230267r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enable kernel parameters to enforce discretionary access control on symlinks."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010374" disa="2165" severity="medium"> -+ <VMSinfo VKey="230268" SVKey="230268r5998" VRelease="r599818"/> -+ <title text="AlmaLinux 8 must enable kernel parameters to enforce discretionary access control on hardlinks."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010375" disa="1090" severity="low"> -+ <VMSinfo VKey="230269" SVKey="230269r5998" VRelease="r599820"/> -+ <title text="AlmaLinux 8 must restrict access to the kernel message buffer."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010376" disa="1090" severity="low"> -+ <VMSinfo VKey="230270" SVKey="230270r5998" VRelease="r599823"/> -+ <title text="AlmaLinux 8 must prevent kernel profiling by unprivileged users."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010380" disa="2038" severity="medium"> -+ <VMSinfo VKey="230271" SVKey="230271r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must require users to provide a password for privilege escalation."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010381" disa="2038" severity="medium"> -+ <VMSinfo VKey="230272" SVKey="230272r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must require users to reauthenticate for privilege escalation."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010390" disa="1948" severity="medium"> -+ <VMSinfo VKey="230273" SVKey="230273r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must have the packages required for multifactor authentication installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010400" disa="1948" severity="medium"> -+ <VMSinfo VKey="230274" SVKey="230274r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must implement certificate status checking for multifactor authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010410" disa="1953" severity="medium"> -+ <VMSinfo VKey="230275" SVKey="230275r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must accept Personal Identity Verification (PIV) credentials."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010420" disa="2824" severity="medium"> -+ <VMSinfo VKey="230276" SVKey="230276r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must implement non-executable data to protect its memory from unauthorized code execution."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010421" disa="1084" severity="medium"> -+ <VMSinfo VKey="230277" SVKey="230277r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must clear the page allocator to prevent use-after-free attacks."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010422" disa="1084" severity="medium"> -+ <VMSinfo VKey="230278" SVKey="230278r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable virtual syscalls."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010423" disa="1084" severity="medium"> -+ <VMSinfo VKey="230279" SVKey="230279r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must clear SLUB/SLAB objects to prevent use-after-free attacks."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010430" disa="2824" severity="medium"> -+ <VMSinfo VKey="230280" SVKey="230280r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must implement address space layout randomization (ASLR) to protect its memory from unauthorized code execution."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010440" disa="2617" severity="low"> -+ <VMSinfo VKey="230281" SVKey="230281r5997" VRelease="r599732"/> -+ <title text="YUM must remove all software components after updated versions have been installed on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010450" disa="2696" severity="medium"> -+ <VMSinfo VKey="230282" SVKey="230282r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enable the SELinux targeted policy."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010460" disa="366" severity="high"> -+ <VMSinfo VKey="230283" SVKey="230283r5997" VRelease="r599732"/> -+ <title text="There must be no shosts.equiv files on the AlmaLinux 8 operating system."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010470" disa="366" severity="high"> -+ <VMSinfo VKey="230284" SVKey="230284r5997" VRelease="r599732"/> -+ <title text="There must be no .shosts files on the AlmaLinux 8 operating system."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010471" disa="366" severity="low"> -+ <VMSinfo VKey="230285" SVKey="230285r5997" VRelease="r599779"/> -+ <title text="AlmaLinux 8 must enable the hardware random number generator entropy gatherer service."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010480" disa="366" severity="medium"> -+ <VMSinfo VKey="230286" SVKey="230286r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH public host key files must have mode 0644 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010490" disa="366" severity="medium"> -+ <VMSinfo VKey="230287" SVKey="230287r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH private host key files must have mode 0640 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010500" disa="366" severity="medium"> -+ <VMSinfo VKey="230288" SVKey="230288r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH daemon must perform strict mode checking of home directory configuration files."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010510" disa="366" severity="medium"> -+ <VMSinfo VKey="230289" SVKey="230289r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH daemon must not allow compression or must only allow compression after successful authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010520" disa="366" severity="medium"> -+ <VMSinfo VKey="230290" SVKey="230290r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH daemon must not allow authentication using known host’s authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010521" disa="366" severity="medium"> -+ <VMSinfo VKey="230291" SVKey="230291r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH daemon must not allow unused methods of authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010540" disa="366" severity="low"> -+ <VMSinfo VKey="230292" SVKey="230292r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must use a separate file system for /var."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010541" disa="366" severity="low"> -+ <VMSinfo VKey="230293" SVKey="230293r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must use a separate file system for /var/log."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010542" disa="366" severity="low"> -+ <VMSinfo VKey="230294" SVKey="230294r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must use a separate file system for the system audit data path."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010543" disa="366" severity="medium"> -+ <VMSinfo VKey="230295" SVKey="230295r5997" VRelease="r599732"/> -+ <title text="A separate AlmaLinux 8 filesystem must be used for the /tmp directory."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010550" disa="770" severity="medium"> -+ <VMSinfo VKey="230296" SVKey="230296r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not permit direct logons to the root account using remote access via SSH."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010560" disa="366" severity="medium"> -+ <VMSinfo VKey="230297" SVKey="230297r5997" VRelease="r599732"/> -+ <title text="The auditd service must be running in AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010561" disa="366" severity="medium"> -+ <VMSinfo VKey="230298" SVKey="230298r5997" VRelease="r599732"/> -+ <title text="The rsyslog service must be running in AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010570" disa="366" severity="medium"> -+ <VMSinfo VKey="230299" SVKey="230299r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent files with the setuid and setgid bit set from being executed on file systems that contain user home directories."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010571" disa="366" severity="medium"> -+ <VMSinfo VKey="230300" SVKey="230300r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent files with the setuid and setgid bit set from being executed on the /boot directory."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010580" disa="366" severity="medium"> -+ <VMSinfo VKey="230301" SVKey="230301r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent special devices on non-root local partitions."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010590" disa="366" severity="medium"> -+ <VMSinfo VKey="230302" SVKey="230302r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent code from being executed on file systems that contain user home directories."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010600" disa="366" severity="medium"> -+ <VMSinfo VKey="230303" SVKey="230303r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent special devices on file systems that are used with removable media."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010610" disa="366" severity="medium"> -+ <VMSinfo VKey="230304" SVKey="230304r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent code from being executed on file systems that are used with removable media."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010620" disa="366" severity="medium"> -+ <VMSinfo VKey="230305" SVKey="230305r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010630" disa="366" severity="medium"> -+ <VMSinfo VKey="230306" SVKey="230306r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent code from being executed on file systems that are imported via Network File System (NFS)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010640" disa="366" severity="medium"> -+ <VMSinfo VKey="230307" SVKey="230307r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent special devices on file systems that are imported via Network File System (NFS)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010650" disa="366" severity="medium"> -+ <VMSinfo VKey="230308" SVKey="230308r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent files with the setuid and setgid bit set from being executed on file systems that are imported via Network File System (NFS)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010660" disa="366" severity="medium"> -+ <VMSinfo VKey="230309" SVKey="230309r5997" VRelease="r599732"/> -+ <title text="Local AlmaLinux 8 initialization files must not execute world-writable programs."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010670" disa="366" severity="medium"> -+ <VMSinfo VKey="230310" SVKey="230310r5997" VRelease="r599780"/> -+ <title text="AlmaLinux 8 must disable kernel dumps unless needed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010671" disa="366" severity="medium"> -+ <VMSinfo VKey="230311" SVKey="230311r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable the kernel.core_pattern."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010672" disa="366" severity="medium"> -+ <VMSinfo VKey="230312" SVKey="230312r5997" VRelease="r599782"/> -+ <title text="AlmaLinux 8 must disable acquiring, saving, and processing core dumps."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010673" disa="366" severity="medium"> -+ <VMSinfo VKey="230313" SVKey="230313r5997" VRelease="r599784"/> -+ <title text="AlmaLinux 8 must disable core dumps for all users."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010674" disa="366" severity="medium"> -+ <VMSinfo VKey="230314" SVKey="230314r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable storing core dumps."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010675" disa="366" severity="medium"> -+ <VMSinfo VKey="230315" SVKey="230315r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable core dump backtraces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010680" disa="366" severity="medium"> -+ <VMSinfo VKey="230316" SVKey="230316r5997" VRelease="r599732"/> -+ <title text="For AlmaLinux 8 systems using Domain Name Servers (DNS) resolution, at least two name servers must be configured."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010690" disa="366" severity="medium"> -+ <VMSinfo VKey="230317" SVKey="230317r5997" VRelease="r599732"/> -+ <title text="Executable search paths within the initialization files of all local interactive AlmaLinux 8 users must only contain paths that resolve to the system default or the users home directory."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010700" disa="366" severity="medium"> -+ <VMSinfo VKey="230318" SVKey="230318r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 world-writable directories must be owned by root, sys, bin, or an application group."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010710" disa="366" severity="medium"> -+ <VMSinfo VKey="230319" SVKey="230319r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 world-writable directories must be group-owned by root, sys, bin, or an application group."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010720" disa="366" severity="medium"> -+ <VMSinfo VKey="230320" SVKey="230320r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local interactive users must have a home directory assigned in the /etc/passwd file."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010730" disa="366" severity="medium"> -+ <VMSinfo VKey="230321" SVKey="230321r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local interactive user home directories must have mode 0750 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010740" disa="366" severity="medium"> -+ <VMSinfo VKey="230322" SVKey="230322r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local interactive user home directories must be group-owned by the home directory owner’s primary group."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010750" disa="366" severity="medium"> -+ <VMSinfo VKey="230323" SVKey="230323r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local interactive user home directories defined in the /etc/passwd file must exist."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010760" disa="366" severity="medium"> -+ <VMSinfo VKey="230324" SVKey="230324r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local interactive user accounts must be assigned a home directory upon creation."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010770" disa="366" severity="medium"> -+ <VMSinfo VKey="230325" SVKey="230325r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local initialization files must have mode 0740 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010780" disa="366" severity="medium"> -+ <VMSinfo VKey="230326" SVKey="230326r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local files and directories must have a valid owner."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010790" disa="366" severity="medium"> -+ <VMSinfo VKey="230327" SVKey="230327r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 local files and directories must have a valid group owner."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010800" disa="366" severity="medium"> -+ <VMSinfo VKey="230328" SVKey="230328r5997" VRelease="r599732"/> -+ <title text="A separate AlmaLinux 8 filesystem must be used for user home directories (such as /home or an equivalent)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010820" disa="366" severity="high"> -+ <VMSinfo VKey="230329" SVKey="230329r5997" VRelease="r599732"/> -+ <title text="Unattended or automatic logon via the AlmaLinux 8 graphical user interface must not be allowed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-010830" disa="366" severity="medium"> -+ <VMSinfo VKey="230330" SVKey="230330r5997" VRelease="r599732"/> -+ <title text="Unattended or automatic logon to AlmaLinux 8 via ssh must not be allowed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020000" disa="16" severity="medium"> -+ <VMSinfo VKey="230331" SVKey="230331r5998" VRelease="r599824"/> -+ <title text="AlmaLinux 8 temporary user accounts must be provisioned with an expiration time of 72 hours or less."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020010" disa="44" severity="medium"> -+ <VMSinfo VKey="230332" SVKey="230332r5998" VRelease="r599827"/> -+ <title text="AlmaLinux 8 must automatically lock an account when three unsuccessful logon attempts occur."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020011" disa="44" severity="medium"> -+ <VMSinfo VKey="230333" SVKey="230333r5998" VRelease="r599828"/> -+ <title text="AlmaLinux 8 must automatically lock an account when three unsuccessful logon attempts occur."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020012" disa="44" severity="medium"> -+ <VMSinfo VKey="230334" SVKey="230334r5998" VRelease="r599829"/> -+ <title text="AlmaLinux 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020013" disa="44" severity="medium"> -+ <VMSinfo VKey="230335" SVKey="230335r5998" VRelease="r599830"/> -+ <title text="AlmaLinux 8 must automatically lock an account when three unsuccessful logon attempts occur during a 15-minute time period."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020014" disa="44" severity="medium"> -+ <VMSinfo VKey="230336" SVKey="230336r5998" VRelease="r599831"/> -+ <title text="AlmaLinux 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020015" disa="44" severity="medium"> -+ <VMSinfo VKey="230337" SVKey="230337r5998" VRelease="r599832"/> -+ <title text="AlmaLinux 8 must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020016" disa="44" severity="medium"> -+ <VMSinfo VKey="230338" SVKey="230338r5998" VRelease="r599833"/> -+ <title text="AlmaLinux 8 must ensure account lockouts persist."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020017" disa="44" severity="medium"> -+ <VMSinfo VKey="230339" SVKey="230339r5998" VRelease="r599834"/> -+ <title text="AlmaLinux 8 must ensure account lockouts persist."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020018" disa="44" severity="medium"> -+ <VMSinfo VKey="230340" SVKey="230340r5998" VRelease="r599835"/> -+ <title text="AlmaLinux 8 must prevent system messages from being presented when three unsuccessful logon attempts occur."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020019" disa="44" severity="medium"> -+ <VMSinfo VKey="230341" SVKey="230341r5998" VRelease="r599836"/> -+ <title text="AlmaLinux 8 must prevent system messages from being presented when three unsuccessful logon attempts occur."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020020" disa="44" severity="medium"> -+ <VMSinfo VKey="230342" SVKey="230342r5998" VRelease="r599837"/> -+ <title text="AlmaLinux 8 must log user name information when unsuccessful logon attempts occur."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020021" disa="44" severity="medium"> -+ <VMSinfo VKey="230343" SVKey="230343r5998" VRelease="r599838"/> -+ <title text="AlmaLinux 8 must log user name information when unsuccessful logon attempts occur."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020022" disa="44" severity="medium"> -+ <VMSinfo VKey="230344" SVKey="230344r5998" VRelease="r599839"/> -+ <title text="AlmaLinux 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020023" disa="44" severity="medium"> -+ <VMSinfo VKey="230345" SVKey="230345r5998" VRelease="r599840"/> -+ <title text="AlmaLinux 8 must include root when automatically locking an account until the locked account is released by an administrator when three unsuccessful logon attempts occur during a 15-minute time period."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020024" disa="54" severity="low"> -+ <VMSinfo VKey="230346" SVKey="230346r5997" VRelease="r599786"/> -+ <title text="AlmaLinux 8 must limit the number of concurrent sessions to ten for all accounts and/or account types."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020030" disa="56" severity="medium"> -+ <VMSinfo VKey="230347" SVKey="230347r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for graphical user sessions."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020040" disa="56" severity="medium"> -+ <VMSinfo VKey="230348" SVKey="230348r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enable a user session lock until that user re-establishes access using established identification and authentication procedures for command line sessions."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020041" disa="56" severity="medium"> -+ <VMSinfo VKey="230349" SVKey="230349r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must ensure session control is automatically started at shell initialization."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020042" disa="56" severity="low"> -+ <VMSinfo VKey="230350" SVKey="230350r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent users from disabling session control mechanisms."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020050" disa="56" severity="medium"> -+ <VMSinfo VKey="230351" SVKey="230351r5997" VRelease="r599792"/> -+ <title text="AlmaLinux 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020060" disa="57" severity="medium"> -+ <VMSinfo VKey="230352" SVKey="230352r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must automatically lock graphical user sessions after 15 minutes of inactivity."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020070" disa="57" severity="medium"> -+ <VMSinfo VKey="230353" SVKey="230353r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must automatically lock command line user sessions after 15 minutes of inactivity."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020080" disa="57" severity="medium"> -+ <VMSinfo VKey="230354" SVKey="230354r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent a user from overriding graphical user interface settings."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020090" disa="187" severity="medium"> -+ <VMSinfo VKey="230355" SVKey="230355r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must map the authenticated identity to the user or group account for PKI-based authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020100" disa="192" severity="medium"> -+ <VMSinfo VKey="230356" SVKey="230356r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must ensure a password complexity module is enabled."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020110" disa="192" severity="medium"> -+ <VMSinfo VKey="230357" SVKey="230357r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enforce password complexity by requiring that at least one uppercase character be used."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020120" disa="193" severity="medium"> -+ <VMSinfo VKey="230358" SVKey="230358r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enforce password complexity by requiring that at least one lower-case character be used."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020130" disa="194" severity="medium"> -+ <VMSinfo VKey="230359" SVKey="230359r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enforce password complexity by requiring that at least one numeric character be used."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020140" disa="195" severity="medium"> -+ <VMSinfo VKey="230360" SVKey="230360r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must require the maximum number of repeating characters of the same character class be limited to four when passwords are changed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020150" disa="195" severity="medium"> -+ <VMSinfo VKey="230361" SVKey="230361r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must require the maximum number of repeating characters be limited to three when passwords are changed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020160" disa="195" severity="medium"> -+ <VMSinfo VKey="230362" SVKey="230362r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must require the change of at least four character classes when passwords are changed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020170" disa="195" severity="medium"> -+ <VMSinfo VKey="230363" SVKey="230363r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must require the change of at least 8 characters when passwords are changed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020180" disa="198" severity="medium"> -+ <VMSinfo VKey="230364" SVKey="230364r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 passwords must have a 24 hours/1 day minimum password lifetime restriction in /etc/shadow."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020190" disa="198" severity="medium"> -+ <VMSinfo VKey="230365" SVKey="230365r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 passwords for new users or password changes must have a 24 hours/1 day minimum password lifetime restriction in /etc/logins.def."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020200" disa="199" severity="medium"> -+ <VMSinfo VKey="230366" SVKey="230366r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 user account passwords must have a 60-day maximum password lifetime restriction."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020210" disa="199" severity="medium"> -+ <VMSinfo VKey="230367" SVKey="230367r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 user account passwords must be configured so that existing passwords are restricted to a 60-day maximum lifetime."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020220" disa="200" severity="medium"> -+ <VMSinfo VKey="230368" SVKey="230368r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 passwords must be prohibited from reuse for a minimum of five generations."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020230" disa="205" severity="medium"> -+ <VMSinfo VKey="230369" SVKey="230369r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 passwords must have a minimum of 15 characters."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020231" disa="205" severity="medium"> -+ <VMSinfo VKey="230370" SVKey="230370r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 passwords for new users must have a minimum of 15 characters."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020240" disa="764" severity="medium"> -+ <VMSinfo VKey="230371" SVKey="230371r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 duplicate User IDs (UIDs) must not exist for interactive users."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020250" disa="765" severity="medium"> -+ <VMSinfo VKey="230372" SVKey="230372r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must implement smart card logon for multifactor authentication for access to interactive accounts."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020260" disa="795" severity="medium"> -+ <VMSinfo VKey="230373" SVKey="230373r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 account identifiers (individuals, groups, roles, and devices) must be disabled after 35 days of inactivity."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020270" disa="1682" severity="medium"> -+ <VMSinfo VKey="230374" SVKey="230374r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 emergency accounts must be automatically removed or disabled after the crisis is resolved or within 72 hours."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020280" disa="1619" severity="medium"> -+ <VMSinfo VKey="230375" SVKey="230375r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 passwords must contain at least one special character."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020290" disa="2007" severity="medium"> -+ <VMSinfo VKey="230376" SVKey="230376r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prohibit the use of cached authentications after one day."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020300" disa="366" severity="medium"> -+ <VMSinfo VKey="230377" SVKey="230377r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent the use of dictionary words for passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020310" disa="366" severity="medium"> -+ <VMSinfo VKey="230378" SVKey="230378r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enforce a delay of at least four seconds between logon prompts following a failed logon attempt."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020320" disa="366" severity="medium"> -+ <VMSinfo VKey="230379" SVKey="230379r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not have unnecessary accounts."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020330" disa="366" severity="high"> -+ <VMSinfo VKey="230380" SVKey="230380r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not have accounts configured with blank or null passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020340" disa="366" severity="low"> -+ <VMSinfo VKey="230381" SVKey="230381r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must display the date and time of the last successful account logon upon logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020350" disa="366" severity="medium"> -+ <VMSinfo VKey="230382" SVKey="230382r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must display the date and time of the last successful account logon upon an SSH logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020351" disa="366" severity="medium"> -+ <VMSinfo VKey="230383" SVKey="230383r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must define default permissions for all authenticated users in such a way that the user can only read and modify their own files."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020352" disa="366" severity="medium"> -+ <VMSinfo VKey="230384" SVKey="230384r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must set the umask value to 077 for all local interactive user accounts."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-020353" disa="366" severity="medium"> -+ <VMSinfo VKey="230385" SVKey="230385r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must define default permissions for logon and non-logon shells."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030000" disa="2233" severity="medium"> -+ <VMSinfo VKey="230386" SVKey="230386r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must be configured to audit the execution of privileged functions and prevent all software from executing at higher privilege levels than users executing the software."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030010" disa="366" severity="medium"> -+ <VMSinfo VKey="230387" SVKey="230387r5997" VRelease="r599732"/> -+ <title text="Cron logging must be implemented in AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030020" disa="139" severity="medium"> -+ <VMSinfo VKey="230388" SVKey="230388r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted of an audit processing failure event."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030030" disa="139" severity="medium"> -+ <VMSinfo VKey="230389" SVKey="230389r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 Information System Security Officer (ISSO) and System Administrator (SA) (at a minimum) must have mail aliases to be notified of an audit processing failure."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030040" disa="140" severity="medium"> -+ <VMSinfo VKey="230390" SVKey="230390r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 System must take appropriate action when an audit processing failure occurs."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030050" disa="140" severity="medium"> -+ <VMSinfo VKey="230391" SVKey="230391r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) must be alerted when the audit storage volume is full."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030060" disa="140" severity="medium"> -+ <VMSinfo VKey="230392" SVKey="230392r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must take appropriate action when the audit storage volume is full."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030061" disa="366" severity="medium"> -+ <VMSinfo VKey="230393" SVKey="230393r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must audit local events."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030062" disa="1851" severity="medium"> -+ <VMSinfo VKey="230394" SVKey="230394r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must label all off-loaded audit logs before sending them to the central log server."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030063" disa="366" severity="low"> -+ <VMSinfo VKey="230395" SVKey="230395r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must resolve audit information before writing to disk."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030070" disa="162" severity="medium"> -+ <VMSinfo VKey="230396" SVKey="230396r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit logs must have a mode of 0600 or less permissive to prevent unauthorized read access."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030080" disa="162" severity="medium"> -+ <VMSinfo VKey="230397" SVKey="230397r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit logs must be owned by root to prevent unauthorized read access."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030090" disa="162" severity="medium"> -+ <VMSinfo VKey="230398" SVKey="230398r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit logs must be group-owned by root to prevent unauthorized read access."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030100" disa="162" severity="medium"> -+ <VMSinfo VKey="230399" SVKey="230399r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit log directory must be owned by root to prevent unauthorized read access."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030110" disa="162" severity="medium"> -+ <VMSinfo VKey="230400" SVKey="230400r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit log directory must be group-owned by root to prevent unauthorized read access."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030120" disa="162" severity="medium"> -+ <VMSinfo VKey="230401" SVKey="230401r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit log directory must have a mode of 0700 or less permissive to prevent unauthorized read access."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030121" disa="162" severity="medium"> -+ <VMSinfo VKey="230402" SVKey="230402r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit system must protect auditing rules from unauthorized change."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030122" disa="162" severity="medium"> -+ <VMSinfo VKey="230403" SVKey="230403r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit system must protect logon UIDs from unauthorized change."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030130" disa="169" severity="medium"> -+ <VMSinfo VKey="230404" SVKey="230404r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030140" disa="169" severity="medium"> -+ <VMSinfo VKey="230405" SVKey="230405r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/security/opasswd."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030150" disa="169" severity="medium"> -+ <VMSinfo VKey="230406" SVKey="230406r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030160" disa="169" severity="medium"> -+ <VMSinfo VKey="230407" SVKey="230407r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030170" disa="169" severity="medium"> -+ <VMSinfo VKey="230408" SVKey="230408r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030171" disa="169" severity="medium"> -+ <VMSinfo VKey="230409" SVKey="230409r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030172" disa="169" severity="medium"> -+ <VMSinfo VKey="230410" SVKey="230410r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/sudoers.d/."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030180" disa="169" severity="medium"> -+ <VMSinfo VKey="230411" SVKey="230411r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit records must contain information to establish what type of events occurred, the source of events, where events occurred, and the outcome of events."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030190" disa="169" severity="medium"> -+ <VMSinfo VKey="230412" SVKey="230412r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the su command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030200" disa="169" severity="medium"> -+ <VMSinfo VKey="230413" SVKey="230413r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must be configured to audit any usage of the lremovexattr system call."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030210" disa="169" severity="medium"> -+ <VMSinfo VKey="230414" SVKey="230414r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must be configured to audit any usage of the removexattr system call."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030220" disa="169" severity="medium"> -+ <VMSinfo VKey="230415" SVKey="230415r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must be configured to audit any usage of the lsetxattr system call."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030230" disa="169" severity="medium"> -+ <VMSinfo VKey="230416" SVKey="230416r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must be configured to audit any usage of the fsetxattr system call."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030240" disa="169" severity="medium"> -+ <VMSinfo VKey="230417" SVKey="230417r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit system must be configured to audit any usage of the fremovexattr system call."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030250" disa="169" severity="medium"> -+ <VMSinfo VKey="230418" SVKey="230418r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the chage command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030260" disa="169" severity="medium"> -+ <VMSinfo VKey="230419" SVKey="230419r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the chcon command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030270" disa="169" severity="medium"> -+ <VMSinfo VKey="230420" SVKey="230420r5997" VRelease="r599794"/> -+ <title text="The AlmaLinux 8 audit system must be configured to audit any usage of the setxattr system call."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030280" disa="169" severity="medium"> -+ <VMSinfo VKey="230421" SVKey="230421r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the ssh-agent in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030290" disa="169" severity="medium"> -+ <VMSinfo VKey="230422" SVKey="230422r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the passwd command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030300" disa="169" severity="medium"> -+ <VMSinfo VKey="230423" SVKey="230423r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the mount command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030301" disa="169" severity="medium"> -+ <VMSinfo VKey="230424" SVKey="230424r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the umount command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030302" disa="169" severity="medium"> -+ <VMSinfo VKey="230425" SVKey="230425r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the mount syscall in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030310" disa="169" severity="medium"> -+ <VMSinfo VKey="230426" SVKey="230426r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the unix_update in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030311" disa="169" severity="medium"> -+ <VMSinfo VKey="230427" SVKey="230427r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of postdrop in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030312" disa="169" severity="medium"> -+ <VMSinfo VKey="230428" SVKey="230428r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of postqueue in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030313" disa="169" severity="medium"> -+ <VMSinfo VKey="230429" SVKey="230429r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of semanage in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030314" disa="169" severity="medium"> -+ <VMSinfo VKey="230430" SVKey="230430r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of setfiles in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030315" disa="169" severity="medium"> -+ <VMSinfo VKey="230431" SVKey="230431r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of userhelper in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030316" disa="169" severity="medium"> -+ <VMSinfo VKey="230432" SVKey="230432r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of setsebool in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030317" disa="169" severity="medium"> -+ <VMSinfo VKey="230433" SVKey="230433r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of unix_chkpwd in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030320" disa="169" severity="medium"> -+ <VMSinfo VKey="230434" SVKey="230434r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the ssh-keysign in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030330" disa="169" severity="medium"> -+ <VMSinfo VKey="230435" SVKey="230435r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the setfacl command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030340" disa="169" severity="medium"> -+ <VMSinfo VKey="230436" SVKey="230436r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the pam_timestamp_check command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030350" disa="169" severity="medium"> -+ <VMSinfo VKey="230437" SVKey="230437r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the newgrp command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030360" disa="169" severity="medium"> -+ <VMSinfo VKey="230438" SVKey="230438r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the init_module command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030361" disa="169" severity="medium"> -+ <VMSinfo VKey="230439" SVKey="230439r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the rename command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030362" disa="169" severity="medium"> -+ <VMSinfo VKey="230440" SVKey="230440r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the renameat command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030363" disa="169" severity="medium"> -+ <VMSinfo VKey="230441" SVKey="230441r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the rmdir command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030364" disa="169" severity="medium"> -+ <VMSinfo VKey="230442" SVKey="230442r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the unlink command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030365" disa="169" severity="medium"> -+ <VMSinfo VKey="230443" SVKey="230443r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the unlinkat command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030370" disa="169" severity="medium"> -+ <VMSinfo VKey="230444" SVKey="230444r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the gpasswd command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030380" disa="169" severity="medium"> -+ <VMSinfo VKey="230445" SVKey="230445r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the finit_module command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030390" disa="169" severity="medium"> -+ <VMSinfo VKey="230446" SVKey="230446r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the delete_module command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030400" disa="169" severity="medium"> -+ <VMSinfo VKey="230447" SVKey="230447r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the crontab command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030410" disa="169" severity="medium"> -+ <VMSinfo VKey="230448" SVKey="230448r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the chsh command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030420" disa="169" severity="medium"> -+ <VMSinfo VKey="230449" SVKey="230449r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the truncate command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030430" disa="169" severity="medium"> -+ <VMSinfo VKey="230450" SVKey="230450r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the openat system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030440" disa="169" severity="medium"> -+ <VMSinfo VKey="230451" SVKey="230451r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the open system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030450" disa="169" severity="medium"> -+ <VMSinfo VKey="230452" SVKey="230452r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the open_by_handle_at system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030460" disa="169" severity="medium"> -+ <VMSinfo VKey="230453" SVKey="230453r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the ftruncate command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030470" disa="169" severity="medium"> -+ <VMSinfo VKey="230454" SVKey="230454r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the creat system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030480" disa="169" severity="medium"> -+ <VMSinfo VKey="230455" SVKey="230455r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the chown command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030490" disa="169" severity="medium"> -+ <VMSinfo VKey="230456" SVKey="230456r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the chmod command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030500" disa="169" severity="medium"> -+ <VMSinfo VKey="230457" SVKey="230457r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the lchown system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030510" disa="169" severity="medium"> -+ <VMSinfo VKey="230458" SVKey="230458r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the fchownat system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030520" disa="169" severity="medium"> -+ <VMSinfo VKey="230459" SVKey="230459r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the fchown system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030530" disa="169" severity="medium"> -+ <VMSinfo VKey="230460" SVKey="230460r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the fchmodat system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030540" disa="169" severity="medium"> -+ <VMSinfo VKey="230461" SVKey="230461r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the fchmod system call in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030550" disa="169" severity="medium"> -+ <VMSinfo VKey="230462" SVKey="230462r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the sudo command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030560" disa="169" severity="medium"> -+ <VMSinfo VKey="230463" SVKey="230463r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the usermod command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030570" disa="169" severity="medium"> -+ <VMSinfo VKey="230464" SVKey="230464r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the chacl command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030580" disa="169" severity="medium"> -+ <VMSinfo VKey="230465" SVKey="230465r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful uses of the kmod command in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030590" disa="169" severity="medium"> -+ <VMSinfo VKey="230466" SVKey="230466r5998" VRelease="r599841"/> -+ <title text="Successful/unsuccessful modifications to the faillock log file in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030600" disa="169" severity="medium"> -+ <VMSinfo VKey="230467" SVKey="230467r5997" VRelease="r599732"/> -+ <title text="Successful/unsuccessful modifications to the lastlog file in AlmaLinux 8 must generate an audit record."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030601" disa="169" severity="low"> -+ <VMSinfo VKey="230468" SVKey="230468r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enable auditing of processes that start prior to the audit daemon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030602" disa="1849" severity="low"> -+ <VMSinfo VKey="230469" SVKey="230469r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must allocate an audit_backlog_limit of sufficient size to capture processes that start prior to the audit daemon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030603" disa="169" severity="low"> -+ <VMSinfo VKey="230470" SVKey="230470r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enable Linux audit logging for the USBGuard daemon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030610" disa="171" severity="medium"> -+ <VMSinfo VKey="230471" SVKey="230471r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must allow only the Information System Security Manager (ISSM) (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030620" disa="1493" severity="medium"> -+ <VMSinfo VKey="230472" SVKey="230472r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit tools must have a mode of 0755 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030630" disa="1493" severity="medium"> -+ <VMSinfo VKey="230473" SVKey="230473r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit tools must be owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030640" disa="1493" severity="medium"> -+ <VMSinfo VKey="230474" SVKey="230474r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 audit tools must be group-owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030650" disa="1496" severity="medium"> -+ <VMSinfo VKey="230475" SVKey="230475r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must use cryptographic mechanisms to protect the integrity of audit tools."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030660" disa="1849" severity="medium"> -+ <VMSinfo VKey="230476" SVKey="230476r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must allocate audit record storage capacity to store at least one week of audit records, when audit records are not immediately sent to a central audit record storage facility."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030670" disa="366" severity="medium"> -+ <VMSinfo VKey="230477" SVKey="230477r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must have the packages required for offloading audit logs installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030680" disa="366" severity="medium"> -+ <VMSinfo VKey="230478" SVKey="230478r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must have the packages required for encrypting offloaded audit logs installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030690" disa="1851" severity="medium"> -+ <VMSinfo VKey="230479" SVKey="230479r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 audit records must be off-loaded onto a different system or storage media from the system being audited."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030700" disa="1851" severity="medium"> -+ <VMSinfo VKey="230480" SVKey="230480r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must take appropriate action when the internal event queue is full."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030710" disa="1851" severity="medium"> -+ <VMSinfo VKey="230481" SVKey="230481r5997" VRelease="r599796"/> -+ <title text="AlmaLinux 8 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030720" disa="1851" severity="medium"> -+ <VMSinfo VKey="230482" SVKey="230482r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must authenticate the remote logging server for off-loading audit logs."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030730" disa="1855" severity="medium"> -+ <VMSinfo VKey="230483" SVKey="230483r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030740" disa="1891" severity="medium"> -+ <VMSinfo VKey="230484" SVKey="230484r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must securely compare internal information system clocks at least every 24 hours with a server synchronized to an authoritative time source, such as the United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030741" disa="381" severity="low"> -+ <VMSinfo VKey="230485" SVKey="230485r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable the chrony daemon from acting as a server."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-030742" disa="381" severity="low"> -+ <VMSinfo VKey="230486" SVKey="230486r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable network management of the chrony daemon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040000" disa="381" severity="high"> -+ <VMSinfo VKey="230487" SVKey="230487r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not have the telnet-server package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040001" disa="381" severity="medium"> -+ <VMSinfo VKey="230488" SVKey="230488r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not have any automated bug reporting tools installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040002" disa="381" severity="medium"> -+ <VMSinfo VKey="230489" SVKey="230489r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not have the sendmail package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040003" disa="381" severity="medium"> -+ <VMSinfo VKey="230490" SVKey="230490r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not have the gssproxy package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040004" disa="381" severity="low"> -+ <VMSinfo VKey="230491" SVKey="230491r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enable mitigations against processor-based vulnerabilities."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040010" disa="381" severity="high"> -+ <VMSinfo VKey="230492" SVKey="230492r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not have the rsh-server package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040020" disa="381" severity="medium"> -+ <VMSinfo VKey="230493" SVKey="230493r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must cover or disable the built-in or attached camera when not in use."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040021" disa="381" severity="low"> -+ <VMSinfo VKey="230494" SVKey="230494r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable the asynchronous transfer mode (ATM) protocol."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040022" disa="381" severity="low"> -+ <VMSinfo VKey="230495" SVKey="230495r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable the controller area network (CAN) protocol."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040023" disa="381" severity="low"> -+ <VMSinfo VKey="230496" SVKey="230496r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable the stream control transmission (SCTP) protocol."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040024" disa="381" severity="low"> -+ <VMSinfo VKey="230497" SVKey="230497r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable the transparent inter-process communication (TIPC) protocol."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040025" disa="381" severity="low"> -+ <VMSinfo VKey="230498" SVKey="230498r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable mounting of cramfs."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040026" disa="381" severity="low"> -+ <VMSinfo VKey="230499" SVKey="230499r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable IEEE 1394 (FireWire) Support."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040030" disa="382" severity="medium"> -+ <VMSinfo VKey="230500" SVKey="230500r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assignments List (CAL) and vulnerability assessments."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040060" disa="1941" severity="high"> -+ <VMSinfo VKey="230501" SVKey="230501r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must enforce SSHv2 for network access to all accounts."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040070" disa="778" severity="medium"> -+ <VMSinfo VKey="230502" SVKey="230502r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 file system automounter must be disabled unless required."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040080" disa="778" severity="medium"> -+ <VMSinfo VKey="230503" SVKey="230503r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must be configured to disable USB mass storage."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040090" disa="2314" severity="medium"> -+ <VMSinfo VKey="230504" SVKey="230504r5997" VRelease="r599732"/> -+ <title text="A AlmaLinux 8 firewall must employ a deny-all, allow-by-exception policy for allowing connections to other systems."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040100" disa="2314" severity="medium"> -+ <VMSinfo VKey="230505" SVKey="230505r5997" VRelease="r599732"/> -+ <title text="A firewall must be installed on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040110" disa="1444" severity="medium"> -+ <VMSinfo VKey="230506" SVKey="230506r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 wireless network adapters must be disabled."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040111" disa="1443" severity="medium"> -+ <VMSinfo VKey="230507" SVKey="230507r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 Bluetooth must be disabled."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040120" disa="1764" severity="medium"> -+ <VMSinfo VKey="230508" SVKey="230508r5997" VRelease="r599797"/> -+ <title text="AlmaLinux 8 must mount /dev/shm with the nodev option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040121" disa="1764" severity="medium"> -+ <VMSinfo VKey="230509" SVKey="230509r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must mount /dev/shm with the nosuid option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040122" disa="1764" severity="medium"> -+ <VMSinfo VKey="230510" SVKey="230510r5997" VRelease="r599798"/> -+ <title text="AlmaLinux 8 must mount /dev/shm with the noexec option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040123" disa="1764" severity="medium"> -+ <VMSinfo VKey="230511" SVKey="230511r5997" VRelease="r599799"/> -+ <title text="AlmaLinux 8 must mount /tmp with the nodev option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040124" disa="1764" severity="medium"> -+ <VMSinfo VKey="230512" SVKey="230512r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must mount /tmp with the nosuid option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040125" disa="1764" severity="medium"> -+ <VMSinfo VKey="230513" SVKey="230513r5998" VRelease="r599800"/> -+ <title text="AlmaLinux 8 must mount /tmp with the noexec option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040126" disa="1764" severity="medium"> -+ <VMSinfo VKey="230514" SVKey="230514r5998" VRelease="r599801"/> -+ <title text="AlmaLinux 8 must mount /var/log with the nodev option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040127" disa="1764" severity="medium"> -+ <VMSinfo VKey="230515" SVKey="230515r5998" VRelease="r599802"/> -+ <title text="AlmaLinux 8 must mount /var/log with the nosuid option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040128" disa="1764" severity="medium"> -+ <VMSinfo VKey="230516" SVKey="230516r5998" VRelease="r599803"/> -+ <title text="AlmaLinux 8 must mount /var/log with the noexec option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040129" disa="1764" severity="medium"> -+ <VMSinfo VKey="230517" SVKey="230517r5998" VRelease="r599804"/> -+ <title text="AlmaLinux 8 must mount /var/log/audit with the nodev option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040130" disa="1764" severity="medium"> -+ <VMSinfo VKey="230518" SVKey="230518r5998" VRelease="r599805"/> -+ <title text="AlmaLinux 8 must mount /var/log/audit with the nosuid option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040131" disa="1764" severity="medium"> -+ <VMSinfo VKey="230519" SVKey="230519r5998" VRelease="r599806"/> -+ <title text="AlmaLinux 8 must mount /var/log/audit with the noexec option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040132" disa="1764" severity="medium"> -+ <VMSinfo VKey="230520" SVKey="230520r5998" VRelease="r599807"/> -+ <title text="AlmaLinux 8 must mount /var/tmp with the nodev option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040133" disa="1764" severity="medium"> -+ <VMSinfo VKey="230521" SVKey="230521r5998" VRelease="r599808"/> -+ <title text="AlmaLinux 8 must mount /var/tmp with the nosuid option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040134" disa="1764" severity="medium"> -+ <VMSinfo VKey="230522" SVKey="230522r5998" VRelease="r599809"/> -+ <title text="AlmaLinux 8 must mount /var/tmp with the noexec option."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040135" disa="1764" severity="medium"> -+ <VMSinfo VKey="230523" SVKey="230523r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 fapolicy module must be configured to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040140" disa="1958" severity="medium"> -+ <VMSinfo VKey="230524" SVKey="230524r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must block unauthorized peripherals before establishing a connection."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040150" disa="2385" severity="medium"> -+ <VMSinfo VKey="230525" SVKey="230525r5997" VRelease="r599732"/> -+ <title text="A firewall must be able to protect against or limit the effects of Denial of Service (DoS) attacks by ensuring AlmaLinux 8 can implement rate-limiting measures on impacted network interfaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040160" disa="2418" severity="medium"> -+ <VMSinfo VKey="230526" SVKey="230526r5997" VRelease="r599732"/> -+ <title text="All AlmaLinux 8 networked systems must have and implement SSH to protect the confidentiality and integrity of transmitted and received information, as well as information during preparation for transmission."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040161" disa="68" severity="medium"> -+ <VMSinfo VKey="230527" SVKey="230527r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must force a frequent session key renegotiation for SSH connections to the server."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040162" disa="68" severity="medium"> -+ <VMSinfo VKey="230528" SVKey="230528r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must force a frequent session key renegotiation for SSH connections by the client."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040170" disa="366" severity="high"> -+ <VMSinfo VKey="230529" SVKey="230529r5998" VRelease="r599811"/> -+ <title text="The x86 Ctrl-Alt-Delete key sequence must be disabled on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040171" disa="366" severity="high"> -+ <VMSinfo VKey="230530" SVKey="230530r5997" VRelease="r599732"/> -+ <title text="The x86 Ctrl-Alt-Delete key sequence in AlmaLinux 8 must be disabled if a graphical user interface is installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040172" disa="366" severity="high"> -+ <VMSinfo VKey="230531" SVKey="230531r5998" VRelease="r599813"/> -+ <title text="The systemd Ctrl-Alt-Delete burst key sequence in AlmaLinux 8 must be disabled."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040180" disa="366" severity="medium"> -+ <VMSinfo VKey="230532" SVKey="230532r5998" VRelease="r599815"/> -+ <title text="The debug-shell systemd service must be disabled on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040190" disa="366" severity="high"> -+ <VMSinfo VKey="230533" SVKey="230533r5997" VRelease="r599732"/> -+ <title text="The Trivial File Transfer Protocol (TFTP) server package must not be installed if not required for AlmaLinux 8 operational support."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040200" disa="366" severity="high"> -+ <VMSinfo VKey="230534" SVKey="230534r5997" VRelease="r599732"/> -+ <title text="The root account must be the only account having unrestricted access to the AlmaLinux 8 system."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040210" disa="366" severity="medium"> -+ <VMSinfo VKey="230535" SVKey="230535r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must prevent Internet Control Message Protocol (ICMP) redirect messages from being accepted."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040220" disa="366" severity="medium"> -+ <VMSinfo VKey="230536" SVKey="230536r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not send Internet Control Message Protocol (ICMP) redirects."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040230" disa="366" severity="medium"> -+ <VMSinfo VKey="230537" SVKey="230537r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not respond to Internet Control Message Protocol (ICMP) echoes sent to a broadcast address."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040240" disa="366" severity="medium"> -+ <VMSinfo VKey="230538" SVKey="230538r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not forward source-routed packets."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040250" disa="366" severity="medium"> -+ <VMSinfo VKey="230539" SVKey="230539r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not forward source-routed packets by default."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040260" disa="366" severity="medium"> -+ <VMSinfo VKey="230540" SVKey="230540r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not be performing packet forwarding unless the system is a router."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040261" disa="366" severity="medium"> -+ <VMSinfo VKey="230541" SVKey="230541r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not accept router advertisements on all IPv6 interfaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040262" disa="366" severity="medium"> -+ <VMSinfo VKey="230542" SVKey="230542r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not accept router advertisements on all IPv6 interfaces by default."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040270" disa="366" severity="medium"> -+ <VMSinfo VKey="230543" SVKey="230543r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must not allow interfaces to perform Internet Control Message Protocol (ICMP) redirects by default."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040280" disa="366" severity="medium"> -+ <VMSinfo VKey="230544" SVKey="230544r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must ignore Internet Control Message Protocol (ICMP) redirect messages."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040281" disa="366" severity="medium"> -+ <VMSinfo VKey="230545" SVKey="230545r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable access to network bpf syscall from unprivileged processes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040282" disa="366" severity="medium"> -+ <VMSinfo VKey="230546" SVKey="230546r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must restrict usage of ptrace to descendant processes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040283" disa="366" severity="medium"> -+ <VMSinfo VKey="230547" SVKey="230547r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must restrict exposed kernel pointer addresses access."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040284" disa="366" severity="medium"> -+ <VMSinfo VKey="230548" SVKey="230548r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must disable the use of user namespaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040285" disa="366" severity="medium"> -+ <VMSinfo VKey="230549" SVKey="230549r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must use reverse path filtering on all IPv4 interfaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040290" disa="366" severity="medium"> -+ <VMSinfo VKey="230550" SVKey="230550r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 must be configured to prevent unrestricted mail relaying."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040300" disa="366" severity="low"> -+ <VMSinfo VKey="230551" SVKey="230551r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 file integrity tool must be configured to verify extended attributes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040310" disa="366" severity="low"> -+ <VMSinfo VKey="230552" SVKey="230552r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 file integrity tool must be configured to verify Access Control Lists (ACLs)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040320" disa="366" severity="medium"> -+ <VMSinfo VKey="230553" SVKey="230553r5997" VRelease="r599732"/> -+ <title text="The graphical display manager must not be installed on AlmaLinux 8 unless approved."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040330" disa="366" severity="medium"> -+ <VMSinfo VKey="230554" SVKey="230554r5997" VRelease="r599732"/> -+ <title text="AlmaLinux 8 network interfaces must not be in promiscuous mode."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040340" disa="366" severity="medium"> -+ <VMSinfo VKey="230555" SVKey="230555r5998" VRelease="r599816"/> -+ <title text="AlmaLinux 8 remote X connections for interactive users must be disabled unless to fulfill documented and validated mission requirements."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040341" disa="366" severity="medium"> -+ <VMSinfo VKey="230556" SVKey="230556r5997" VRelease="r599732"/> -+ <title text="The AlmaLinux 8 SSH daemon must prevent remote hosts from connecting to the proxy display."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040350" disa="366" severity="medium"> -+ <VMSinfo VKey="230557" SVKey="230557r5997" VRelease="r599732"/> -+ <title text="If the Trivial File Transfer Protocol (TFTP) server is required, the AlmaLinux 8 TFTP daemon must be configured to operate in secure mode."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040360" disa="366" severity="high"> -+ <VMSinfo VKey="230558" SVKey="230558r5997" VRelease="r599732"/> -+ <title text="A File Transfer Protocol (FTP) server package must not be installed unless mission essential on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040370" disa="366" severity="medium"> -+ <VMSinfo VKey="230559" SVKey="230559r5997" VRelease="r599732"/> -+ <title text="The gssproxy package must not be installed unless mission essential on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040380" disa="366" severity="medium"> -+ <VMSinfo VKey="230560" SVKey="230560r5997" VRelease="r599732"/> -+ <title text="The iprutils package must not be installed unless mission essential on AlmaLinux 8."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="RHEL-08-040390" disa="366" severity="medium"> -+ <VMSinfo VKey="230561" SVKey="230561r5997" VRelease="r599732"/> -+ <title text="The tuned package must not be installed unless mission essential on AlmaLinux 8."/> -+ </overlay> -+</overlays> -diff --git a/almalinux8/product.yml b/almalinux8/product.yml -new file mode 100644 -index 00000000..1b4f12b9 ---- /dev/null -+++ b/almalinux8/product.yml -@@ -0,0 +1,27 @@ -+product: almalinux8 -+full_name: AlmaLinux 8 -+type: platform -+ -+benchmark_root: "../linux_os/guide" -+ -+profiles_root: "./profiles" -+ -+pkg_manager: "yum" -+ -+init_system: "systemd" -+ -+oval_feed_url: "https://security.almalinux.org/oval/org.almalinux.alsa-8.xml" -+ -+pkg_release: "5ffd890e" -+pkg_version: "3abb34f8" -+ -+cpes_root: "../shared/applicability" -+cpes: -+ - almalinux8: -+ name: "cpe:/o:almalinux:almalinux:8" -+ title: "AlmaLinux 8" -+ check_id: installed_OS_is_almalinux8 -+ -+# Mapping of CPE platform to package -+platform_package_overrides: -+ login_defs: "shadow-utils" -diff --git a/almalinux8/profiles/anssi_bp28_enhanced.profile b/almalinux8/profiles/anssi_bp28_enhanced.profile -new file mode 100644 -index 00000000..bbc11353 ---- /dev/null -+++ b/almalinux8/profiles/anssi_bp28_enhanced.profile -@@ -0,0 +1,16 @@ -+documentation_complete: true -+ -+title: 'ANSSI-BP-028 (enhanced)' -+ -+description: |- -+ This profile contains configurations that align to ANSSI-BP-028 at the enhanced hardening level. -+ -+ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -+ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. -+ -+ A copy of the ANSSI-BP-028 can be found at the ANSSI website: -+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ -+ -+selections: -+ - anssi:all:enhanced -+ - '!selinux_state' -diff --git a/almalinux8/profiles/anssi_bp28_high.profile b/almalinux8/profiles/anssi_bp28_high.profile -new file mode 100644 -index 00000000..848612ec ---- /dev/null -+++ b/almalinux8/profiles/anssi_bp28_high.profile -@@ -0,0 +1,15 @@ -+documentation_complete: false -+ -+title: 'DRAFT - ANSSI-BP-028 (high)' -+ -+description: |- -+ This profile contains configurations that align to ANSSI-BP-028 at the high hardening level. -+ -+ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -+ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. -+ -+ A copy of the ANSSI-BP-028 can be found at the ANSSI website: -+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ -+ -+selections: -+ - anssi:all:high -diff --git a/almalinux8/profiles/anssi_bp28_intermediary.profile b/almalinux8/profiles/anssi_bp28_intermediary.profile -new file mode 100644 -index 00000000..a5920316 ---- /dev/null -+++ b/almalinux8/profiles/anssi_bp28_intermediary.profile -@@ -0,0 +1,15 @@ -+documentation_complete: true -+ -+title: 'ANSSI-BP-028 (intermediary)' -+ -+description: |- -+ This profile contains configurations that align to ANSSI-BP-028 at the intermediary hardening level. -+ -+ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -+ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. -+ -+ A copy of the ANSSI-BP-028 can be found at the ANSSI website: -+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ -+ -+selections: -+ - anssi:all:intermediary -diff --git a/almalinux8/profiles/anssi_bp28_minimal.profile b/almalinux8/profiles/anssi_bp28_minimal.profile -new file mode 100644 -index 00000000..cef83941 ---- /dev/null -+++ b/almalinux8/profiles/anssi_bp28_minimal.profile -@@ -0,0 +1,16 @@ -+documentation_complete: true -+ -+title: 'ANSSI-BP-028 (minimal)' -+ -+description: |- -+ This profile contains configurations that align to ANSSI-BP-028 at the minimal hardening level. -+ -+ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. -+ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. -+ -+ A copy of the ANSSI-BP-028 can be found at the ANSSI website: -+ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ -+ -+selections: -+ - anssi:all:minimal -+ -diff --git a/almalinux8/profiles/cis.profile b/almalinux8/profiles/cis.profile -new file mode 100644 -index 00000000..f2728200 ---- /dev/null -+++ b/almalinux8/profiles/cis.profile -@@ -0,0 +1,1089 @@ -+documentation_complete: true -+ -+metadata: -+ version: 1.0.0 -+ SMEs: -+ - vojtapolasek -+ - yuumasato -+ -+reference: https://www.cisecurity.org/benchmark/almalinux/ -+ -+title: 'CIS AlmaLinux 8 Benchmark' -+ -+description: |- -+ This profile defines a baseline that aligns to the Center for Internet Security® -+ AlmaLinux 8 Benchmark™, v1.0.0, DRAFT, released 08-20-2021. -+ -+ This profile includes Center for Internet Security® -+ AlmaLinux 8 CIS Benchmarks™ content. -+ -+selections: -+ # Necessary for dconf rules -+ - dconf_db_up_to_date -+ -+ ### Partitioning -+ - mount_option_home_nodev -+ -+ ## 1.1 Filesystem Configuration -+ -+ ### 1.1.1 Disable unused filesystems -+ -+ #### 1.1.1.1 Ensure mounting cramfs filesystems is disabled (Scored) -+ - kernel_module_cramfs_disabled -+ -+ #### 1.1.1.2 Ensure mounting of vFAT filesystems is limited (Not Scored) -+ -+ -+ #### 1.1.1.3 Ensure mounting of squashfs filesystems is disabled (Scored) -+ - kernel_module_squashfs_disabled -+ -+ #### 1.1.1.4 Ensure mounting of udf filesystems is disabled (Scored) -+ - kernel_module_udf_disabled -+ -+ ### 1.1.2 Ensure /tmp is configured (Scored) -+ - partition_for_tmp -+ -+ ### 1.1.3 Ensure nodev option set on /tmp partition (Scored) -+ - mount_option_tmp_nodev -+ -+ ### 1.1.4 Ensure nosuid option set on /tmp partition (Scored) -+ - mount_option_tmp_nosuid -+ -+ ### 1.1.5 Ensure noexec option set on /tmp partition (Scored) -+ - mount_option_tmp_noexec -+ -+ ### 1.1.6 Ensure separate partition exists for /var (Scored) -+ - partition_for_var -+ -+ ### 1.1.7 Ensure separate partition exists for /var/tmp (Scored) -+ - partition_for_var_tmp -+ -+ ### 1.1.8 Ensure nodev option set on /var/tmp partition (Scored) -+ - mount_option_var_tmp_nodev -+ -+ ### 1.1.9 Ensure nosuid option set on /var/tmp partition (Scored) -+ - mount_option_var_tmp_nosuid -+ -+ ### 1.1.10 Ensure noexec option set on /var/tmp partition (Scored) -+ - mount_option_var_tmp_noexec -+ -+ ### 1.1.11 Ensure separate partition exists for /var/log (Scored) -+ - partition_for_var_log -+ -+ ### 1.1.12 Ensure separate partition exists for /var/log/audit (Scored) -+ - partition_for_var_log_audit -+ -+ ### 1.1.13 Ensure separate partition exists for /home (Scored) -+ - partition_for_home -+ -+ ### 1.1.14 Ensure nodev option set on /home partition (Scored) -+ - mount_option_home_nodev -+ -+ ### 1.1.15 Ensure nodev option set on /dev/shm partition (Scored) -+ - mount_option_dev_shm_nodev -+ -+ ### 1.1.16 Ensure nosuid option set on /dev/shm partition (Scored) -+ - mount_option_dev_shm_nosuid -+ -+ ### 1.1.17 Ensure noexec option set on /dev/shm partition (Scored) -+ - mount_option_dev_shm_noexec -+ -+ ### 1.1.18 Ensure nodev option set on removable media partitions (Not Scored) -+ - mount_option_nodev_removable_partitions -+ -+ ### 1.1.19 Ensure nosuid option set on removable media partitions (Not Scored) -+ - mount_option_nosuid_removable_partitions -+ -+ ### 1.1.20 Ensure noexec option set on removable media partitions (Not Scored) -+ - mount_option_noexec_removable_partitions -+ -+ ### 1.1.21 Ensure sticky bit is set on all world-writable directories (Scored) -+ - dir_perms_world_writable_sticky_bits -+ -+ ### 1.1.22 Disable Automounting (Scored) -+ - service_autofs_disabled -+ -+ ### 1.1.23 Disable USB Storage (Scored) -+ - kernel_module_usb-storage_disabled -+ -+ ## 1.2 Configure Software Updates -+ -+ ### 1.2.1 Ensure Red Hat Subscription Manager connection is configured (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5218 -+ -+ ### 1.2.2 Disable the rhnsd Daemon (Not Scored) -+ - service_rhnsd_disabled -+ -+ ### 1.2.3 Ensure GPG keys are configured (Not Scored) -+ - ensure_almalinux_gpgkey_installed -+ -+ ### 1.2.4 Ensure gpgcheck is globally activated (Scored) -+ - ensure_gpgcheck_globally_activated -+ -+ ### 1.2.5 Ensure package manager repositories are configured (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5219 -+ -+ ## 1.3 Configure sudo -+ -+ ### 1.3.1 Ensure sudo is installed (Scored) -+ - package_sudo_installed -+ -+ ### 1.3.2 Ensure sudo commands use pty (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5220 -+ -+ ### 1.3.3 Ensure sudo log file exists (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5221 -+ -+ ## 1.4 Filesystem Integrity Checking -+ -+ ### 1.4.1 Ensure AIDE is installed (Scored) -+ - package_aide_installed -+ -+ ### 1.4.2 Ensure filesystem integrity is regularly checked (Scored) -+ - aide_periodic_cron_checking -+ -+ ## Secure Boot Settings -+ -+ ### 1.5.1 Ensure permissions on bootloader config are configured (Scored) -+ #### chown root:root /boot/grub2/grub.cfg -+ - file_owner_grub2_cfg -+ - file_groupowner_grub2_cfg -+ -+ #### chmod og-rwx /boot/grub2/grub.cfg -+ - file_permissions_grub2_cfg -+ -+ #### chown root:root /boot/grub2/grubenv -+ # NEED RULE - https://github.com/ComplianceAsCode/content/issues/5222 -+ -+ #### chmod og-rwx /boot/grub2/grubenv -+ # NEED RULE - https://github.com/ComplianceAsCode/content/issues/5222 -+ -+ ### 1.5.2 Ensure bootloader password is set (Scored) -+ - grub2_password -+ -+ ### 1.5.3 Ensure authentication required for single user mode (Scored) -+ #### ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue -+ - require_singleuser_auth -+ -+ #### ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency -+ - require_emergency_target_auth -+ -+ ## 1.6 Additional Process Hardening -+ -+ ### 1.6.1 Ensure core dumps are restricted (Scored) -+ #### * hard core 0 -+ - disable_users_coredumps -+ -+ #### fs.suid_dumpable = 0 -+ - sysctl_fs_suid_dumpable -+ -+ #### ProcessSizeMax=0 -+ - coredump_disable_backtraces -+ -+ #### Storage=none -+ - coredump_disable_storage -+ -+ ### 1.6.2 Ensure address space layout randomization (ASLR) is enabled -+ - sysctl_kernel_randomize_va_space -+ -+ ## 1.7 Mandatory Access Control -+ -+ ### 1.7.1 Configure SELinux -+ -+ #### 1.7.1.1 Ensure SELinux is installed (Scored) -+ - package_libselinux_installed -+ -+ #### 1.7.1.2 Ensure SELinux is not disabled in bootloader configuration (Scored) -+ - grub2_enable_selinux -+ -+ #### 1.7.1.3 Ensure SELinux policy is configured (Scored) -+ - var_selinux_policy_name=targeted -+ - selinux_policytype -+ -+ #### 1.7.1.4 Ensure the SELinux state is enforcing (Scored) -+ - var_selinux_state=enforcing -+ - selinux_state -+ -+ #### 1.7.1.5 Ensure no unconfied services exist (Scored) -+ - selinux_confinement_of_daemons -+ -+ #### 1.7.1.6 Ensure SETroubleshoot is not installed (Scored) -+ - package_setroubleshoot_removed -+ -+ #### 1.7.1.7 Ensure the MCS Translation Service (mcstrans) is not installed (Scored) -+ - package_mcstrans_removed -+ -+ ## Warning Banners -+ -+ ### 1.8.1 Command Line Warning Baners -+ -+ #### 1.8.1.1 Ensure message of the day is configured properly (Scored) -+ - banner_etc_motd -+ -+ #### 1.8.1.2 Ensure local login warning banner is configured properly (Scored) -+ - banner_etc_issue -+ -+ #### 1.8.1.3 Ensure remote login warning banner is configured properly (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5225 -+ -+ #### 1.8.1.4 Ensure permissions on /etc/motd are configured (Scored) -+ # chmod u-x,go-wx /etc/motd -+ - file_permissions_etc_motd -+ -+ #### 1.8.1.5 Ensure permissions on /etc/issue are configured (Scored) -+ # chmod u-x,go-wx /etc/issue -+ - file_permissions_etc_issue -+ -+ #### 1.8.1.6 Ensure permissions on /etc/issue.net are configured (Scored) -+ # Previously addressed via 'rpm_verify_permissions' rule -+ -+ ### 1.8.2 Ensure GDM login banner is configured (Scored) -+ #### banner-message-enable=true -+ - dconf_gnome_banner_enabled -+ -+ #### banner-message-text='<banner message>' -+ - dconf_gnome_login_banner_text -+ -+ ## 1.9 Ensure updates, patches, and additional security software are installed (Scored) -+ - security_patches_up_to_date -+ -+ ## 1.10 Ensure system-wide crypto policy is not legacy (Scored) -+ #- var_system_crypto_policy -+ - configure_crypto_policy -+ -+ ## 1.11 Ensure system-wide crytpo policy is FUTURE or FIPS (Scored) -+ # Previously addressed via 'configure_crypto_policy' rule -+ -+ # Services -+ -+ ## 2.1 inetd Services -+ -+ ### 2.1.1 Ensure xinetd is not installed (Scored) -+ - package_xinetd_removed -+ -+ ## 2.2 Special Purpose Services -+ -+ ### 2.2.1 Time Synchronization -+ -+ #### 2.2.1.1 Ensure time synchronization is in use (Not Scored) -+ - package_chrony_installed -+ -+ #### 2.2.1.2 Ensure chrony is configured (Scored) -+ - service_chronyd_enabled -+ - chronyd_specify_remote_server -+ - chronyd_run_as_chrony_user -+ -+ ### 2.2.2 Ensure X Window System is not installed (Scored) -+ - package_xorg-x11-server-common_removed -+ - xwindows_runlevel_target -+ -+ ### 2.2.3 Ensure rsync service is not enabled (Scored) -+ - service_rsyncd_disabled -+ -+ ### 2.2.4 Ensure Avahi Server is not enabled (Scored) -+ - service_avahi-daemon_disabled -+ -+ ### 2.2.5 Ensure SNMP Server is not enabled (Scored) -+ - service_snmpd_disabled -+ -+ ### 2.2.6 Ensure HTTP Proxy Server is not enabled (Scored) -+ - package_squid_removed -+ -+ ### 2.2.7 Ensure Samba is not enabled (Scored) -+ - service_smb_disabled -+ -+ ### 2.2.8 Ensure IMAP and POP3 server is not enabled (Scored) -+ - service_dovecot_disabled -+ -+ ### 2.2.9 Ensure HTTP server is not enabled (Scored) -+ - service_httpd_disabled -+ -+ ### 2.2.10 Ensure FTP Server is not enabled (Scored) -+ - service_vsftpd_disabled -+ -+ ### 2.2.11 Ensure DNS Server is not enabled (Scored) -+ - service_named_disabled -+ -+ ### 2.2.12 Ensure NFS is not enabled (Scored) -+ - service_nfs_disabled -+ -+ ### 2.2.13 Ensure RPC is not enabled (Scored) -+ - service_rpcbind_disabled -+ -+ ### 2.2.14 Ensure LDAP service is not enabled (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5231 -+ -+ ### 2.2.15 Ensure DHCP Server is not enabled (Scored) -+ - service_dhcpd_disabled -+ -+ ### 2.2.16 Ensure CUPS is not enabled (Scored) -+ - service_cups_disabled -+ -+ ### 2.2.17 Ensure NIS Server is not enabled (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5232 -+ -+ ### 2.2.18 Ensure mail transfer agent is configured for -+ ### local-only mode (Scored) -+ - postfix_network_listening_disabled -+ -+ ## 2.3 Service Clients -+ -+ ### 2.3.1 Ensure NIS Client is not installed (Scored) -+ - package_ypbind_removed -+ -+ ### 2.3.2 Ensure telnet client is not installed (Scored) -+ - package_telnet_removed -+ -+ ### Ensure LDAP client is not installed -+ - package_openldap-clients_removed -+ -+ # 3 Network Configuration -+ -+ ## 3.1 Network Parameters (Host Only) -+ -+ ### 3.1.1 Ensure IP forwarding is disabled (Scored) -+ #### net.ipv4.ip_forward = 0 -+ - sysctl_net_ipv4_ip_forward -+ -+ #### net.ipv6.conf.all.forwarding = 0 -+ - sysctl_net_ipv6_conf_all_forwarding -+ -+ ### 3.1.2 Ensure packet redirect sending is disabled (Scored) -+ #### net.ipv4.conf.all.send_redirects = 0 -+ - sysctl_net_ipv4_conf_all_send_redirects -+ -+ #### net.ipv4.conf.default.send_redirects = 0 -+ - sysctl_net_ipv4_conf_default_send_redirects -+ -+ ## 3.2 Network Parameters (Host and Router) -+ -+ ### 3.2.1 Ensure source routed packets are not accepted (Scored) -+ #### net.ipv4.conf.all.accept_source_route = 0 -+ - sysctl_net_ipv4_conf_all_accept_source_route -+ -+ #### net.ipv4.conf.default.accept_source_route = 0 -+ - sysctl_net_ipv4_conf_default_accept_source_route -+ -+ #### net.ipv6.conf.all.accept_source_route = 0 -+ - sysctl_net_ipv6_conf_all_accept_source_route -+ -+ #### net.ipv6.conf.default.accept_source_route = 0 -+ - sysctl_net_ipv6_conf_default_accept_source_route -+ -+ ### 3.2.2 Ensure ICMP redirects are not accepted (Scored) -+ #### net.ipv4.conf.all.accept_redirects = 0 -+ - sysctl_net_ipv4_conf_all_accept_redirects -+ -+ #### net.ipv4.conf.default.accept_redirects -+ - sysctl_net_ipv4_conf_default_accept_redirects -+ -+ #### net.ipv6.conf.all.accept_redirects = 0 -+ - sysctl_net_ipv6_conf_all_accept_redirects -+ -+ #### net.ipv6.conf.defaults.accept_redirects = 0 -+ - sysctl_net_ipv6_conf_default_accept_redirects -+ -+ ### 3.2.3 Ensure secure ICMP redirects are not accepted (Scored) -+ #### net.ipv4.conf.all.secure_redirects = 0 -+ - sysctl_net_ipv4_conf_all_secure_redirects -+ -+ #### net.ipv4.cof.default.secure_redirects = 0 -+ - sysctl_net_ipv4_conf_default_secure_redirects -+ -+ ### 3.2.4 Ensure suspicious packets are logged (Scored) -+ #### net.ipv4.conf.all.log_martians = 1 -+ - sysctl_net_ipv4_conf_all_log_martians -+ -+ #### net.ipv4.conf.default.log_martians = 1 -+ - sysctl_net_ipv4_conf_default_log_martians -+ -+ ### 3.2.5 Ensure broadcast ICMP requests are ignored (Scored) -+ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts -+ -+ ### 3.2.6 Ensure bogus ICMP responses are ignored (Scored) -+ - sysctl_net_ipv4_icmp_ignore_bogus_error_responses -+ -+ ### 3.2.7 Ensure Reverse Path Filtering is enabled (Scored) -+ #### net.ipv4.conf.all.rp_filter = 1 -+ - sysctl_net_ipv4_conf_all_rp_filter -+ -+ #### net.ipv4.conf.default.rp_filter = 1 -+ - sysctl_net_ipv4_conf_default_rp_filter -+ -+ ### 3.2.8 Ensure TCP SYN Cookies is enabled (Scored) -+ - sysctl_net_ipv4_tcp_syncookies -+ -+ ### 3.2.9 Ensure IPv6 router advertisements are not accepted (Scored) -+ #### net.ipv6.conf.all.accept_ra = 0 -+ - sysctl_net_ipv6_conf_all_accept_ra -+ -+ #### net.ipv6.conf.default.accept_ra = 0 -+ - sysctl_net_ipv6_conf_default_accept_ra -+ -+ ## 3.3 Uncommon Network Protocols -+ -+ ### 3.3.1 Ensure DCCP is disabled (Scored) -+ - kernel_module_dccp_disabled -+ -+ ### Ensure SCTP is disabled (Scored) -+ - kernel_module_sctp_disabled -+ -+ ### 3.3.3 Ensure RDS is disabled (Scored) -+ - kernel_module_rds_disabled -+ -+ ### 3.3.4 Ensure TIPC is disabled (Scored) -+ - kernel_module_tipc_disabled -+ -+ ## 3.4 Firewall Configuration -+ -+ ### 3.4.1 Ensure Firewall software is installed -+ -+ #### 3.4.1.1 Ensure a Firewall package is installed (Scored) -+ ##### firewalld -+ - package_firewalld_installed -+ -+ ##### nftables -+ #NEED RULE - https://github.com/ComplianceAsCode/content/issues/5237 -+ -+ ##### iptables -+ #- package_iptables_installed -+ -+ ### 3.4.2 Configure firewalld -+ -+ #### 3.4.2.1 Ensure firewalld service is enabled and running (Scored) -+ - service_firewalld_enabled -+ -+ #### 3.4.2.2 Ensure iptables is not enabled (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5238 -+ -+ #### 3.4.2.3 Ensure nftables is not enabled (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5239 -+ -+ #### 3.4.2.4 Ensure default zone is set (Scored) -+ - set_firewalld_default_zone -+ -+ #### 3.4.2.5 Ensure network interfaces are assigned to -+ #### appropriate zone (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5240 -+ -+ #### 3.4.2.6 Ensure unnecessary services and ports are not -+ #### accepted (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5241 -+ -+ ### 3.4.3 Configure nftables -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5242 -+ -+ #### 3.4.3.1 Ensure iptables are flushed (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5243 -+ -+ #### 3.4.3.2 Ensure a table exists (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5244 -+ -+ #### 3.4.3.3 Ensure base chains exist (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5245 -+ -+ #### 3.4.3.4 Ensure loopback traffic is configured (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5246 -+ -+ #### 3.4.3.5 Ensure outbound and established connections are -+ #### configured (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5247 -+ -+ #### 3.4.3.6 Ensure default deny firewall policy (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5248 -+ -+ #### 3.4.3.7 Ensure nftables service is enabled (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5249 -+ -+ #### 3.4.3.8 Ensure nftables rules are permanent (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5250 -+ -+ ### 3.4.4 Configure iptables -+ -+ #### 3.4.4.1 Configure IPv4 iptables -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5251 -+ -+ ##### 3.4.4.1.1 Ensure default deny firewall policy (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5252 -+ -+ ##### 3.4.4.1.2 Ensure loopback traffic is configured (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5253 -+ -+ ##### 3.4.4.1.3 Ensure outbound and established connections are -+ ##### configured (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5254 -+ -+ ##### 3.4.4.1.4 Ensure firewall rules exist for all open ports (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5255 -+ -+ #### 3.4.4.2 Configure IPv6 ip6tables -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5256 -+ -+ ##### 3.4.4.2.1 Ensure IPv6 default deny firewall policy (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5257 -+ -+ ##### 3.4.4.2.2 Ensure IPv6 loopback traffic is configured (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5258 -+ -+ ##### 3.4.4.2.3 Ensure IPv6 outbound and established connections are -+ ##### configured (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5260 -+ -+ ## 3.5 Ensure wireless interfaces are disabled (Scored) -+ - wireless_disable_interfaces -+ -+ ## 3.6 Disable IPv6 (Not Scored) -+ - kernel_module_ipv6_option_disabled -+ -+ # Logging and Auditing -+ -+ ## 4.1 Configure System Accounting (auditd) -+ -+ ### 4.1.1 Ensure auditing is enabled -+ -+ #### 4.1.1.1 Ensure auditd is installed (Scored) -+ - package_audit_installed -+ -+ #### 4.1.1.2 Ensure auditd service is enabled (Scored) -+ - service_auditd_enabled -+ -+ #### 4.1.1.3 Ensure auditing for processes that start prior to audit -+ #### is enabled (Scored) -+ - grub2_audit_argument -+ -+ #### 4.1.1.4 Ensure audit_backlog_limit is sufficient (Scored) -+ - grub2_audit_backlog_limit_argument -+ -+ ### 4.1.2 Configure Data Retention -+ -+ #### 4.1.2.1 Ensure audit log storage size is configured (Scored) -+ - auditd_data_retention_max_log_file -+ -+ #### 4.1.2.2 Ensure audit logs are not automatically deleted (Scored) -+ - auditd_data_retention_max_log_file_action -+ -+ #### 4.1.2.3 Ensure system is disabled when audit logs are full (Scored) -+ - var_auditd_space_left_action=email -+ - auditd_data_retention_space_left_action -+ -+ ##### action_mail_acct = root -+ - var_auditd_action_mail_acct=root -+ - auditd_data_retention_action_mail_acct -+ -+ ##### admin_space_left_action = halt -+ - var_auditd_admin_space_left_action=halt -+ - auditd_data_retention_admin_space_left_action -+ -+ ### 4.1.3 Ensure changes to system administration scope -+ ### (sudoers) is collected (Scored) -+ - audit_rules_sysadmin_actions -+ -+ ### 4.1.4 Ensure login and logout events are collected (Scored) -+ - audit_rules_login_events_faillock -+ - audit_rules_login_events_lastlog -+ -+ ### 4.1.5 Ensure session initiation information is collected (Scored) -+ - audit_rules_session_events -+ -+ ### 4.1.6 Ensure events that modify date and time information -+ ### are collected (Scored) -+ #### adjtimex -+ - audit_rules_time_adjtimex -+ -+ #### settimeofday -+ - audit_rules_time_settimeofday -+ -+ #### stime -+ - audit_rules_time_stime -+ -+ #### clock_settime -+ - audit_rules_time_clock_settime -+ -+ #### -w /etc/localtime -p wa -+ - audit_rules_time_watch_localtime -+ -+ ### 4.1.7 Ensure events that modify the system's Mandatory -+ ### Access Control are collected (Scored) -+ #### -w /etc/selinux/ -p wa -+ - audit_rules_mac_modification -+ -+ #### -w /usr/share/selinux/ -p wa -+ # NEED RULE - https://github.com/ComplianceAsCode/content/issues/5264 -+ -+ ### 4.1.8 Ensure events that modify the system's network -+ ### enironment are collected (Scored) -+ - audit_rules_networkconfig_modification -+ -+ ### 4.1.9 Ensure discretionary access control permission modification -+ ### events are collected (Scored) -+ - audit_rules_dac_modification_chmod -+ - audit_rules_dac_modification_fchmod -+ - audit_rules_dac_modification_fchmodat -+ - audit_rules_dac_modification_chown -+ - audit_rules_dac_modification_fchown -+ - audit_rules_dac_modification_fchownat -+ - audit_rules_dac_modification_lchown -+ - audit_rules_dac_modification_setxattr -+ - audit_rules_dac_modification_lsetxattr -+ - audit_rules_dac_modification_fsetxattr -+ - audit_rules_dac_modification_removexattr -+ - audit_rules_dac_modification_lremovexattr -+ - audit_rules_dac_modification_fremovexattr -+ -+ ### 4.1.10 Ensure unsuccessful unauthorized file access attempts are -+ ### collected (Scored) -+ - audit_rules_unsuccessful_file_modification_creat -+ - audit_rules_unsuccessful_file_modification_open -+ - audit_rules_unsuccessful_file_modification_openat -+ - audit_rules_unsuccessful_file_modification_truncate -+ - audit_rules_unsuccessful_file_modification_ftruncate -+ # Opinionated selection -+ - audit_rules_unsuccessful_file_modification_open_by_handle_at -+ -+ ### 4.1.11 Ensure events that modify user/group information are -+ ### collected (Scored) -+ - audit_rules_usergroup_modification_passwd -+ - audit_rules_usergroup_modification_group -+ - audit_rules_usergroup_modification_gshadow -+ - audit_rules_usergroup_modification_shadow -+ - audit_rules_usergroup_modification_opasswd -+ -+ ### 4.1.12 Ensure successful file system mounts are collected (Scored) -+ - audit_rules_media_export -+ -+ ### 4.1.13 Ensure use of privileged commands is collected (Scored) -+ - audit_rules_privileged_commands -+ -+ ### 4.1.14 Ensure file deletion events by users are collected -+ ### (Scored) -+ - audit_rules_file_deletion_events_unlink -+ - audit_rules_file_deletion_events_unlinkat -+ - audit_rules_file_deletion_events_rename -+ - audit_rules_file_deletion_events_renameat -+ # Opinionated selection -+ - audit_rules_file_deletion_events_rmdir -+ -+ ### 4.1.15 Ensure kernel module loading and unloading is collected -+ ### (Scored) -+ - audit_rules_kernel_module_loading -+ -+ ### 4.1.16 Ensure system administrator actions (sudolog) are -+ ### collected (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5516 -+ -+ ### 4.1.17 Ensure the audit configuration is immutable (Scored) -+ - audit_rules_immutable -+ -+ ## 4.2 Configure Logging -+ -+ ### 4.2.1 Configure rsyslog -+ -+ #### 4.2.1.1 Ensure rsyslog is installed (Scored) -+ - package_rsyslog_installed -+ -+ #### 4.2.1.2 Ensure rsyslog Service is enabled (Scored) -+ - service_rsyslog_enabled -+ -+ #### 4.2.1.3 Ensure rsyslog default file permissions configured (Scored) -+ - rsyslog_files_permissions -+ -+ #### 4.2.1.4 Ensure logging is configured (Not Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5519 -+ -+ #### 4.2.1.5 Ensure rsyslog is configured to send logs to a remote -+ #### log host (Scored) -+ - rsyslog_remote_loghost -+ -+ #### 4.2.1.6 Ensure remote rsyslog messages are only accepted on -+ #### designated log hosts (Not Scored) -+ - rsyslog_nolisten -+ -+ ### 4.2.2 Configure journald -+ -+ #### 4.2.2.1 Ensure journald is configured to send logs to -+ #### rsyslog (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5520 -+ -+ #### 4.2.2.2 Ensure journald is configured to compress large -+ #### log files (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5521 -+ -+ -+ #### 4.2.2.3 Ensure journald is configured to write logfiles to -+ #### persistent disk (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5522 -+ -+ ### 4.2.3 Ensure permissions on all logfiles are configured (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5523 -+ -+ ## 4.3 Ensure logrotate is conifgured (Not Scored) -+ - ensure_logrotate_activated -+ -+ # 5 Access, Authentication and Authorization -+ -+ ## 5.1 Configure cron -+ -+ ### 5.1.1 Ensure cron daemon is enabled (Scored) -+ - service_crond_enabled -+ -+ -+ ### 5.1.2 Ensure permissions on /etc/crontab are configured (Scored) -+ # chown root:root /etc/crontab -+ - file_owner_crontab -+ - file_groupowner_crontab -+ # chmod og-rwx /etc/crontab -+ - file_permissions_crontab -+ -+ ### 5.1.3 Ensure permissions on /etc/cron.hourly are configured (Scored) -+ # chown root:root /etc/cron.hourly -+ - file_owner_cron_hourly -+ - file_groupowner_cron_hourly -+ # chmod og-rwx /etc/cron.hourly -+ - file_permissions_cron_hourly -+ -+ ### 5.1.4 Ensure permissions on /etc/cron.daily are configured (Scored) -+ # chown root:root /etc/cron.daily -+ - file_owner_cron_daily -+ - file_groupowner_cron_daily -+ # chmod og-rwx /etc/cron.daily -+ - file_permissions_cron_daily -+ -+ ### 5.1.5 Ensure permissions on /etc/cron.weekly are configured (Scored) -+ # chown root:root /etc/cron.weekly -+ - file_owner_cron_weekly -+ - file_groupowner_cron_weekly -+ # chmod og-rwx /etc/cron.weekly -+ - file_permissions_cron_weekly -+ -+ ### 5.1.6 Ensure permissions on /etc/cron.monthly are configured (Scored) -+ # chown root:root /etc/cron.monthly -+ - file_owner_cron_monthly -+ - file_groupowner_cron_monthly -+ # chmod og-rwx /etc/cron.monthly -+ - file_permissions_cron_monthly -+ -+ ### 5.1.7 Ensure permissions on /etc/cron.d are configured (Scored) -+ # chown root:root /etc/cron.d -+ - file_owner_cron_d -+ - file_groupowner_cron_d -+ # chmod og-rwx /etc/cron.d -+ - file_permissions_cron_d -+ -+ ### 5.1.8 Ensure at/cron is restricted to authorized users (Scored) -+ -+ -+ ## 5.2 SSH Server Configuration -+ -+ ### 5.2.1 Ensure permissions on /etc/ssh/sshd_config are configured (Scored) -+ # chown root:root /etc/ssh/sshd_config -+ - file_owner_sshd_config -+ - file_groupowner_sshd_config -+ -+ # chmod og-rwx /etc/ssh/sshd_config -+ - file_permissions_sshd_config -+ -+ ### 5.2.2 Ensure SSH access is limited (Scored) -+ -+ -+ ### 5.2.3 Ensure permissions on SSH private host key files are -+ ### configured (Scored) -+ # TO DO: The rule sets to 640, but benchmark wants 600 -+ - file_permissions_sshd_private_key -+ # TO DO: check owner of private keys in /etc/ssh is root:root -+ -+ ### 5.2.4 Ensure permissions on SSH public host key files are configured -+ ### (Scored) -+ - file_permissions_sshd_pub_key -+ # TO DO: check owner of pub keys in /etc/ssh is root:root -+ -+ ### 5.2.5 Ensure SSH LogLevel is appropriate (Scored) -+ - sshd_set_loglevel_info -+ -+ ### 5.2.6 Ensure SSH X11 forward is disabled (Scored) -+ - sshd_disable_x11_forwarding -+ -+ ### 5.2.7 Ensure SSH MaxAuthTries is set to 4 or less (Scored) -+ - sshd_max_auth_tries_value=4 -+ - sshd_set_max_auth_tries -+ -+ ### 5.2.8 Ensure SSH IgnoreRhosts is enabled (Scored) -+ - sshd_disable_rhosts -+ -+ ### 5.2.9 Ensure SSH HostbasedAuthentication is disabled (Scored) -+ - disable_host_auth -+ -+ ### 5.2.10 Ensure SSH root login is disabled (Scored) -+ - sshd_disable_root_login -+ -+ ### 5.2.11 Ensure SSH PermitEmptyPasswords is disabled (Scored) -+ - sshd_disable_empty_passwords -+ -+ ### 5.2.12 Ensure SSH PermitUserEnvironment is disabled (Scored) -+ - sshd_do_not_permit_user_env -+ -+ ### 5.2.13 Ensure SSH Idle Timeout Interval is configured (Scored) -+ # ClientAliveInterval 300 -+ - sshd_idle_timeout_value=5_minutes -+ - sshd_set_idle_timeout -+ -+ # ClientAliveCountMax 0 -+ - sshd_set_keepalive -+ -+ ### 5.2.14 Ensure SSH LoginGraceTime is set to one minute -+ ### or less (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5525 -+ -+ ### 5.2.15 Ensure SSH warning banner is configured (Scored) -+ - sshd_enable_warning_banner -+ -+ ### 5.2.16 Ensure SSH PAM is enabled (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5526 -+ -+ ### 5.2.17 Ensure SSH AllowTcpForwarding is disabled (Scored) -+ - sshd_disable_tcp_forwarding -+ -+ ### 5.2.18 Ensure SSH MaxStarups is configured (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5528 -+ -+ ### 5.2.19 Ensure SSH MaxSessions is set to 4 or less (Scored) -+ - sshd_set_max_sessions -+ - var_sshd_max_sessions=4 -+ -+ ### 5.2.20 Ensure system-wide crypto policy is not over-ridden (Scored) -+ - configure_ssh_crypto_policy -+ -+ ## 5.3 Configure authselect -+ -+ -+ ### 5.3.1 Create custom authselectet profile (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5530 -+ -+ ### 5.3.2 Select authselect profile (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5531 -+ -+ ### 5.3.3 Ensure authselect includes with-faillock (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5532 -+ -+ ## 5.4 Configure PAM -+ -+ ### 5.4.1 Ensure password creation requirements are configured (Scored) -+ # NEEDS RULE: try_first_pass - https://github.com/ComplianceAsCode/content/issues/5533 -+ - accounts_password_pam_retry -+ - var_password_pam_minlen=14 -+ - accounts_password_pam_minlen -+ - var_password_pam_minclass=4 -+ - accounts_password_pam_minclass -+ -+ ### 5.4.2 Ensure lockout for failed password attempts is -+ ### configured (Scored) -+ - var_accounts_passwords_pam_faillock_unlock_time=900 -+ - var_accounts_passwords_pam_faillock_deny=5 -+ - accounts_passwords_pam_faillock_unlock_time -+ - accounts_passwords_pam_faillock_deny -+ -+ ### 5.4.3 Ensure password reuse is limited (Scored) -+ - var_password_pam_unix_remember=5 -+ - accounts_password_pam_unix_remember -+ -+ ### 5.4.4 Ensure password hashing algorithm is SHA-512 (Scored) -+ - set_password_hashing_algorithm_systemauth -+ -+ ## 5.5 User Accounts and Environment -+ -+ ### 5.5.1 Set Shadow Password Suite Parameters -+ -+ #### 5.5.1 Ensure password expiration is 365 days or less (Scored) -+ - var_accounts_maximum_age_login_defs=365 -+ - accounts_maximum_age_login_defs -+ -+ #### 5.5.1.2 Ensure minimum days between password changes is 7 -+ #### or more (Scored) -+ - var_accounts_minimum_age_login_defs=7 -+ - accounts_minimum_age_login_defs -+ -+ #### 5.5.1.3 Ensure password expiration warning days is -+ #### 7 or more (Scored) -+ - var_accounts_password_warn_age_login_defs=7 -+ - accounts_password_warn_age_login_defs -+ -+ #### 5.5.1.4 Ensure inactive password lock is 30 days or less (Scored) -+ # TODO: Rule doesn't check list of users -+ # https://github.com/ComplianceAsCode/content/issues/5536 -+ - var_account_disable_post_pw_expiration=30 -+ - account_disable_post_pw_expiration -+ -+ #### 5.5.1.5 Ensure all users last password change date is -+ #### in the past (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5537 -+ -+ ### 5.5.2 Ensure system accounts are secured (Scored) -+ - no_shelllogin_for_systemaccounts -+ -+ ### 5.5.3 Ensure default user shell timeout is 900 seconds -+ ### or less (Scored) -+ - var_accounts_tmout=15_min -+ - accounts_tmout -+ -+ ### 5.5.4 Ensure default group for the root account is -+ ### GID 0 (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5539 -+ -+ ### 5.5.5 Ensure default user mask is 027 or more restrictive (Scored) -+ - var_accounts_user_umask=027 -+ - accounts_umask_etc_bashrc -+ - accounts_umask_etc_profile -+ -+ ## 5.6 Ensure root login is restricted to system console (Not Scored) -+ - securetty_root_login_console_only -+ - no_direct_root_logins -+ -+ ## 5.7 Ensure access to the su command is restricted (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5541 -+ -+ # System Maintenance -+ -+ ## 6.1 System File Permissions -+ -+ ### 6.1.1 Audit system file permissions (Not Scored) -+ - rpm_verify_permissions -+ - rpm_verify_ownership -+ -+ ### 6.1.2 Ensure permissions on /etc/passwd are configured (Scored) -+ # chown root:root /etc/passwd -+ - file_owner_etc_passwd -+ - file_groupowner_etc_passwd -+ -+ # chmod 644 /etc/passwd -+ - file_permissions_etc_passwd -+ -+ ### 6.1.3 Ensure permissions on /etc/shadow are configured (Scored) -+ # chown root:root /etc/shadow -+ - file_owner_etc_shadow -+ - file_groupowner_etc_shadow -+ -+ # chmod o-rwx,g-wx /etc/shadow -+ - file_permissions_etc_shadow -+ -+ ### 6.1.4 Ensure permissions on /etc/group are configured (Scored) -+ # chown root:root /etc/group -+ - file_owner_etc_group -+ - file_groupowner_etc_group -+ -+ # chmod 644 /etc/group -+ - file_permissions_etc_group -+ -+ ### 6.1.5 Ensure permissions on /etc/gshadow are configured (Scored) -+ # chown root:root /etc/gshadow -+ - file_owner_etc_gshadow -+ - file_groupowner_etc_gshadow -+ -+ # chmod o-rwx,g-rw /etc/gshadow -+ - file_permissions_etc_gshadow -+ -+ ### 6.1.6 Ensure permissions on /etc/passwd- are configured (Scored) -+ # chown root:root /etc/passwd- -+ - file_owner_backup_etc_passwd -+ - file_groupowner_backup_etc_passwd -+ -+ # chmod 644 /etc/passwd- -+ - file_permissions_backup_etc_passwd -+ -+ ### 6.1.7 Ensure permissions on /etc/shadow- are configured (Scored) -+ # chown root:root /etc/shadow- -+ - file_owner_backup_etc_shadow -+ - file_groupowner_backup_etc_shadow -+ -+ # chmod 0000 /etc/shadow- -+ - file_permissions_backup_etc_shadow -+ -+ ### 6.1.8 Ensure permissions on /etc/group- are configured (Scored) -+ # chown root:root /etc/group- -+ - file_owner_backup_etc_group -+ - file_groupowner_backup_etc_group -+ -+ # chmod 644 /etc/group- -+ - file_permissions_backup_etc_group -+ -+ ### 6.1.9 Ensure permissions on /etc/gshadow- are configured (Scored) -+ # chown root:root /etc/gshadow- -+ - file_owner_backup_etc_gshadow -+ - file_groupowner_backup_etc_gshadow -+ -+ # chmod 0000 /etc/gshadow- -+ - file_permissions_backup_etc_gshadow -+ -+ ### 6.1.10 Ensure no world writable files exist (Scored) -+ - file_permissions_unauthorized_world_writable -+ -+ ### 6.1.11 Ensure no unowned files or directories exist (Scored) -+ - no_files_unowned_by_user -+ -+ ### 6.1.12 Ensure no ungrouped files or directories exist (Scored) -+ - file_permissions_ungroupowned -+ -+ ### 6.1.13 Audit SUID executables (Not Scored) -+ - file_permissions_unauthorized_suid -+ -+ ### 6.1.14 Audit SGID executables (Not Scored) -+ - file_permissions_unauthorized_sgid -+ -+ ## 6.2 User and Group Settings -+ -+ ### 6.2.2 Ensure no legacy "+" entries exist in /etc/passwd (Scored) -+ - no_legacy_plus_entries_etc_passwd -+ -+ ### 6.2.4 Ensure no legacy "+" entries exist in /etc/shadow (Scored) -+ - no_legacy_plus_entries_etc_shadow -+ -+ ### 6.2.5 Ensure no legacy "+" entries exist in /etc/group (Scored) -+ - no_legacy_plus_entries_etc_group -+ -+ ### 6.2.6 Ensure root is the only UID 0 account (Scored) -+ - accounts_no_uid_except_zero -+ -+ ### 6.2.7 Ensure users' home directories permissions are 750 -+ ### or more restrictive (Scored) -+ - file_permissions_home_dirs -+ -+ ### 6.2.8 Ensure users own their home directories (Scored) -+ # NEEDS RULE for user owner @ https://github.com/ComplianceAsCode/content/issues/5507 -+ - file_groupownership_home_directories -+ -+ ### 6.2.9 Ensure users' dot files are not group or world -+ ### writable (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5506 -+ -+ ### 6.2.10 Ensure no users have .forward files (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5505 -+ -+ ### 6.2.11 Ensure no users have .netrc files (Scored) -+ - no_netrc_files -+ -+ ### 6.2.12 Ensure users' .netrc Files are not group or -+ ### world accessible (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5504 -+ -+ ### 6.2.13 Ensure no users have .rhosts files (Scored) -+ - no_rsh_trust_files -+ -+ ### 6.2.14 Ensure all groups in /etc/passwd exist in -+ ### /etc/group (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5503 -+ -+ ### 6.2.15 Ensure no duplicate UIDs exist (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5502 -+ -+ ### 6.2.16 Ensure no duplicate GIDs exist (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5501 -+ -+ ### 6.2.17 Ensure no duplicate user names exist (Scored) -+ - account_unique_name -+ -+ ### 6.2.18 Ensure no duplicate group names exist (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5500 -+ -+ ### 6.2.19 Ensure shadow group is empty (Scored) -+ # NEEDS RULE - https://github.com/ComplianceAsCode/content/issues/5499 -+ -+ ### 6.2.20 Ensure all users' home directories exist (Scored) -+ - accounts_user_interactive_home_directory_exists -diff --git a/almalinux8/profiles/cjis.profile b/almalinux8/profiles/cjis.profile -new file mode 100644 -index 00000000..5a410244 ---- /dev/null -+++ b/almalinux8/profiles/cjis.profile -@@ -0,0 +1,139 @@ -+documentation_complete: false -+ -+metadata: -+ version: 5.4 -+ SMEs: -+ - carlosmmatos -+ -+reference: https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center -+ -+title: 'Criminal Justice Information Services (CJIS) Security Policy' -+ -+description: |- -+ This profile is derived from FBI's CJIS v5.4 -+ Security Policy. A copy of this policy can be found at the CJIS Security -+ Policy Resource Center: -+ -+ https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center -+ -+selections: -+ - service_auditd_enabled -+ - grub2_audit_argument -+ - auditd_data_retention_num_logs -+ - auditd_data_retention_max_log_file -+ - auditd_data_retention_max_log_file_action -+ - auditd_data_retention_space_left_action -+ - auditd_data_retention_admin_space_left_action -+ - auditd_data_retention_action_mail_acct -+ - auditd_audispd_syslog_plugin_activated -+ - audit_rules_time_adjtimex -+ - audit_rules_time_settimeofday -+ - audit_rules_time_stime -+ - audit_rules_time_clock_settime -+ - audit_rules_time_watch_localtime -+ - audit_rules_usergroup_modification -+ - audit_rules_networkconfig_modification -+ - file_permissions_var_log_audit -+ - file_ownership_var_log_audit -+ - audit_rules_mac_modification -+ - audit_rules_dac_modification_chmod -+ - audit_rules_dac_modification_chown -+ - audit_rules_dac_modification_fchmod -+ - audit_rules_dac_modification_fchmodat -+ - audit_rules_dac_modification_fchown -+ - audit_rules_dac_modification_fchownat -+ - audit_rules_dac_modification_fremovexattr -+ - audit_rules_dac_modification_fsetxattr -+ - audit_rules_dac_modification_lchown -+ - audit_rules_dac_modification_lremovexattr -+ - audit_rules_dac_modification_lsetxattr -+ - audit_rules_dac_modification_removexattr -+ - audit_rules_dac_modification_setxattr -+ - audit_rules_login_events -+ - audit_rules_session_events -+ - audit_rules_unsuccessful_file_modification -+ - audit_rules_privileged_commands -+ - audit_rules_media_export -+ - audit_rules_file_deletion_events -+ - audit_rules_sysadmin_actions -+ - audit_rules_kernel_module_loading -+ - audit_rules_immutable -+ - account_unique_name -+ - gid_passwd_group_same -+ - accounts_password_all_shadowed -+ - no_empty_passwords -+ - display_login_attempts -+ - var_accounts_password_minlen_login_defs=12 -+ - var_accounts_maximum_age_login_defs=90 -+ - var_password_pam_unix_remember=10 -+ - var_account_disable_post_pw_expiration=0 -+ - var_password_pam_minlen=12 -+ - var_accounts_minimum_age_login_defs=1 -+ - var_password_pam_difok=6 -+ - var_accounts_max_concurrent_login_sessions=3 -+ - account_disable_post_pw_expiration -+ - accounts_password_pam_minlen -+ - accounts_minimum_age_login_defs -+ - accounts_password_pam_difok -+ - accounts_max_concurrent_login_sessions -+ - set_password_hashing_algorithm_systemauth -+ - set_password_hashing_algorithm_logindefs -+ - set_password_hashing_algorithm_libuserconf -+ - file_owner_etc_shadow -+ - file_groupowner_etc_shadow -+ - file_permissions_etc_shadow -+ - file_owner_etc_group -+ - file_groupowner_etc_group -+ - file_permissions_etc_group -+ - file_owner_etc_passwd -+ - file_groupowner_etc_passwd -+ - file_permissions_etc_passwd -+ - file_owner_grub2_cfg -+ - file_groupowner_grub2_cfg -+ - var_password_pam_retry=5 -+ - var_accounts_passwords_pam_faillock_deny=5 -+ - var_accounts_passwords_pam_faillock_unlock_time=600 -+ - dconf_db_up_to_date -+ - dconf_gnome_screensaver_idle_delay -+ - dconf_gnome_screensaver_idle_activation_enabled -+ - dconf_gnome_screensaver_lock_enabled -+ - dconf_gnome_screensaver_mode_blank -+ - sshd_allow_only_protocol2 -+ - sshd_set_idle_timeout -+ - sshd_set_keepalive -+ - disable_host_auth -+ - sshd_disable_root_login -+ - sshd_disable_empty_passwords -+ - sshd_enable_warning_banner -+ - sshd_do_not_permit_user_env -+ - var_system_crypto_policy=fips -+ - configure_crypto_policy -+ - configure_ssh_crypto_policy -+ - kernel_module_dccp_disabled -+ - kernel_module_sctp_disabled -+ - service_firewalld_enabled -+ - set_firewalld_default_zone -+ - firewalld_sshd_port_enabled -+ - sshd_idle_timeout_value=30_minutes -+ - inactivity_timeout_value=30_minutes -+ - sysctl_net_ipv4_conf_default_accept_source_route -+ - sysctl_net_ipv4_tcp_syncookies -+ - sysctl_net_ipv4_conf_all_send_redirects -+ - sysctl_net_ipv4_conf_default_send_redirects -+ - sysctl_net_ipv4_conf_all_accept_redirects -+ - sysctl_net_ipv4_conf_default_accept_redirects -+ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts -+ - var_password_pam_ocredit=1 -+ - var_password_pam_dcredit=1 -+ - var_password_pam_ucredit=1 -+ - var_password_pam_lcredit=1 -+ - package_aide_installed -+ - aide_build_database -+ - aide_periodic_cron_checking -+ - rpm_verify_permissions -+ - rpm_verify_hashes -+ - ensure_almalinux_gpgkey_installed -+ - ensure_gpgcheck_globally_activated -+ - ensure_gpgcheck_never_disabled -+ - security_patches_up_to_date -+ - kernel_module_bluetooth_disabled -diff --git a/almalinux8/profiles/cui.profile b/almalinux8/profiles/cui.profile -new file mode 100644 -index 00000000..bf6d9511 ---- /dev/null -+++ b/almalinux8/profiles/cui.profile -@@ -0,0 +1,32 @@ -+documentation_complete: true -+ -+metadata: -+ version: TBD -+ SMEs: -+ - carlosmmatos -+ -+title: 'Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)' -+ -+description: |- -+ From NIST 800-171, Section 2.2: -+ Security requirements for protecting the confidentiality of CUI in nonfederal -+ information systems and organizations have a well-defined structure that -+ consists of: -+ -+ (i) a basic security requirements section; -+ (ii) a derived security requirements section. -+ -+ The basic security requirements are obtained from FIPS Publication 200, which -+ provides the high-level and fundamental security requirements for federal -+ information and information systems. The derived security requirements, which -+ supplement the basic security requirements, are taken from the security controls -+ in NIST Special Publication 800-53. -+ -+ This profile configures Red Hat Enterprise Linux 8 to the NIST Special -+ Publication 800-53 controls identified for securing Controlled Unclassified -+ Information (CUI)." -+ -+extends: ospp -+ -+selections: -+ - inactivity_timeout_value=10_minutes -diff --git a/almalinux8/profiles/e8.profile b/almalinux8/profiles/e8.profile -new file mode 100644 -index 00000000..049f3ea2 ---- /dev/null -+++ b/almalinux8/profiles/e8.profile -@@ -0,0 +1,149 @@ -+documentation_complete: true -+ -+metadata: -+ SMEs: -+ - shaneboulden -+ -+reference: https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers -+ -+title: 'Australian Cyber Security Centre (ACSC) Essential Eight' -+ -+description: |- -+ This profile contains configuration checks for AlmaLinux 8 -+ that align to the Australian Cyber Security Centre (ACSC) Essential Eight. -+ -+ A copy of the Essential Eight in Linux Environments guide can be found at the -+ ACSC website: -+ -+ https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers -+ -+selections: -+ -+ ### Remove obsolete packages -+ - package_talk_removed -+ - package_talk-server_removed -+ - package_xinetd_removed -+ - service_xinetd_disabled -+ - package_ypbind_removed -+ - package_telnet_removed -+ - service_telnet_disabled -+ - package_telnet-server_removed -+ - package_rsh_removed -+ - package_rsh-server_removed -+ - service_zebra_disabled -+ - package_quagga_removed -+ - service_avahi-daemon_disabled -+ - package_squid_removed -+ - service_squid_disabled -+ -+ ### Software update -+ - ensure_almalinux_gpgkey_installed -+ - ensure_gpgcheck_never_disabled -+ - ensure_gpgcheck_local_packages -+ - ensure_gpgcheck_globally_activated -+ - security_patches_up_to_date -+ - dnf-automatic_security_updates_only -+ -+ ### System security settings -+ - sysctl_kernel_randomize_va_space -+ - sysctl_kernel_exec_shield -+ - sysctl_kernel_kptr_restrict -+ - sysctl_kernel_dmesg_restrict -+ - sysctl_kernel_kexec_load_disabled -+ - sysctl_kernel_yama_ptrace_scope -+ - sysctl_kernel_unprivileged_bpf_disabled -+ - sysctl_net_core_bpf_jit_harden -+ -+ ### SELinux -+ - var_selinux_state=enforcing -+ - selinux_state -+ - var_selinux_policy_name=targeted -+ - selinux_policytype -+ -+ ### Filesystem integrity -+ - rpm_verify_hashes -+ - rpm_verify_permissions -+ - rpm_verify_ownership -+ - file_permissions_unauthorized_sgid -+ - file_permissions_unauthorized_suid -+ - file_permissions_unauthorized_world_writable -+ - dir_perms_world_writable_sticky_bits -+ - file_permissions_library_dirs -+ - file_ownership_binary_dirs -+ - file_permissions_binary_dirs -+ - file_ownership_library_dirs -+ -+ ### Passwords -+ - no_empty_passwords -+ -+ ### Partitioning -+ - mount_option_dev_shm_nodev -+ - mount_option_dev_shm_nosuid -+ - mount_option_dev_shm_noexec -+ -+ ### Network -+ - package_firewalld_installed -+ - service_firewalld_enabled -+ - network_sniffer_disabled -+ -+ ### Admin privileges -+ - accounts_no_uid_except_zero -+ - sudo_remove_nopasswd -+ - sudo_remove_no_authenticate -+ - sudo_require_authentication -+ -+ ### Audit -+ - package_rsyslog_installed -+ - service_rsyslog_enabled -+ - service_auditd_enabled -+ - var_auditd_flush=incremental_async -+ - auditd_data_retention_flush -+ - auditd_local_events -+ - auditd_write_logs -+ - auditd_log_format -+ - auditd_freq -+ - auditd_name_format -+ - audit_rules_login_events_tallylog -+ - audit_rules_login_events_faillock -+ - audit_rules_login_events_lastlog -+ - audit_rules_login_events -+ - audit_rules_time_adjtimex -+ - audit_rules_time_clock_settime -+ - audit_rules_time_watch_localtime -+ - audit_rules_time_settimeofday -+ - audit_rules_time_stime -+ - audit_rules_execution_restorecon -+ - audit_rules_execution_chcon -+ - audit_rules_execution_semanage -+ - audit_rules_execution_setsebool -+ - audit_rules_execution_setfiles -+ - audit_rules_execution_seunshare -+ - audit_rules_sysadmin_actions -+ - audit_rules_networkconfig_modification -+ - audit_rules_usergroup_modification -+ - audit_rules_dac_modification_chmod -+ - audit_rules_dac_modification_chown -+ - audit_rules_kernel_module_loading -+ -+ ### Secure access -+ - sshd_disable_root_login -+ - sshd_disable_gssapi_auth -+ - sshd_print_last_log -+ - sshd_do_not_permit_user_env -+ - sshd_disable_rhosts -+ - sshd_set_loglevel_info -+ - sshd_disable_empty_passwords -+ - sshd_disable_user_known_hosts -+ - sshd_enable_strictmodes -+ -+ # See also: https://www.cyber.gov.au/ism/guidelines-using-cryptography -+ - var_system_crypto_policy=default_nosha1 -+ - configure_crypto_policy -+ - configure_ssh_crypto_policy -+ -+ ### Application whitelisting -+ - package_fapolicyd_installed -+ - service_fapolicyd_enabled -+ -+ ### Backup -+ - package_rear_installed -diff --git a/almalinux8/profiles/hipaa.profile b/almalinux8/profiles/hipaa.profile -new file mode 100644 -index 00000000..5d88f3d3 ---- /dev/null -+++ b/almalinux8/profiles/hipaa.profile -@@ -0,0 +1,164 @@ -+documentation_complete: True -+ -+metadata: -+ SMEs: -+ - jjaswanson4 -+ - carlosmmatos -+ -+reference: https://www.hhs.gov/hipaa/for-professionals/index.html -+ -+title: 'Health Insurance Portability and Accountability Act (HIPAA)' -+ -+description: |- -+ The HIPAA Security Rule establishes U.S. national standards to protect individuals’ -+ electronic personal health information that is created, received, used, or -+ maintained by a covered entity. The Security Rule requires appropriate -+ administrative, physical and technical safeguards to ensure the -+ confidentiality, integrity, and security of electronic protected health -+ information. -+ -+ This profile configures AlmaLinux 8 to the HIPAA Security -+ Rule identified for securing of electronic protected health information. -+ Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). -+ -+selections: -+ - grub2_password -+ - grub2_uefi_password -+ - file_groupowner_grub2_cfg -+ - file_permissions_grub2_cfg -+ - file_owner_grub2_cfg -+ - grub2_disable_interactive_boot -+ - no_direct_root_logins -+ - no_empty_passwords -+ - require_singleuser_auth -+ - restrict_serial_port_logins -+ - securetty_root_login_console_only -+ - service_debug-shell_disabled -+ - disable_ctrlaltdel_reboot -+ - disable_ctrlaltdel_burstaction -+ - dconf_db_up_to_date -+ - dconf_gnome_remote_access_credential_prompt -+ - dconf_gnome_remote_access_encryption -+ - sshd_disable_empty_passwords -+ - sshd_disable_root_login -+ - libreswan_approved_tunnels -+ - no_rsh_trust_files -+ - package_rsh-server_removed -+ - package_talk_removed -+ - package_talk-server_removed -+ - package_telnet_removed -+ - package_telnet-server_removed -+ - package_xinetd_removed -+ - service_crond_enabled -+ - service_rexec_disabled -+ - service_rlogin_disabled -+ - service_telnet_disabled -+ - service_xinetd_disabled -+ - service_zebra_disabled -+ - use_kerberos_security_all_exports -+ - disable_host_auth -+ - sshd_allow_only_protocol2 -+ - sshd_disable_compression -+ - sshd_disable_gssapi_auth -+ - sshd_disable_kerb_auth -+ - sshd_do_not_permit_user_env -+ - sshd_enable_strictmodes -+ - sshd_enable_warning_banner -+ - sshd_set_keepalive -+ - encrypt_partitions -+ - var_system_crypto_policy=fips -+ - configure_crypto_policy -+ - configure_ssh_crypto_policy -+ - var_selinux_policy_name=targeted -+ - var_selinux_state=enforcing -+ - grub2_enable_selinux -+ - sebool_selinuxuser_execheap -+ - sebool_selinuxuser_execmod -+ - sebool_selinuxuser_execstack -+ - selinux_confinement_of_daemons -+ - selinux_policytype -+ - selinux_state -+ - service_kdump_disabled -+ - sysctl_fs_suid_dumpable -+ - sysctl_kernel_dmesg_restrict -+ - sysctl_kernel_exec_shield -+ - sysctl_kernel_randomize_va_space -+ - rpm_verify_hashes -+ - rpm_verify_permissions -+ - ensure_almalinux_gpgkey_installed -+ - ensure_gpgcheck_globally_activated -+ - ensure_gpgcheck_never_disabled -+ - ensure_gpgcheck_local_packages -+ - grub2_audit_argument -+ - service_auditd_enabled -+ - audit_rules_privileged_commands_sudo -+ - audit_rules_privileged_commands_su -+ - audit_rules_immutable -+ - kernel_module_usb-storage_disabled -+ - service_autofs_disabled -+ - auditd_audispd_syslog_plugin_activated -+ - rsyslog_remote_loghost -+ - auditd_data_retention_flush -+ - audit_rules_dac_modification_chmod -+ - audit_rules_dac_modification_chown -+ - audit_rules_dac_modification_fchmodat -+ - audit_rules_dac_modification_fchmod -+ - audit_rules_dac_modification_fchownat -+ - audit_rules_dac_modification_fchown -+ - audit_rules_dac_modification_fremovexattr -+ - audit_rules_dac_modification_fsetxattr -+ - audit_rules_dac_modification_lchown -+ - audit_rules_dac_modification_lremovexattr -+ - audit_rules_dac_modification_lsetxattr -+ - audit_rules_dac_modification_removexattr -+ - audit_rules_dac_modification_setxattr -+ - audit_rules_execution_chcon -+ - audit_rules_execution_restorecon -+ - audit_rules_execution_semanage -+ - audit_rules_execution_setsebool -+ - audit_rules_file_deletion_events_renameat -+ - audit_rules_file_deletion_events_rename -+ - audit_rules_file_deletion_events_rmdir -+ - audit_rules_file_deletion_events_unlinkat -+ - audit_rules_file_deletion_events_unlink -+ - audit_rules_kernel_module_loading_delete -+ - audit_rules_kernel_module_loading_init -+ - audit_rules_login_events_faillock -+ - audit_rules_login_events_lastlog -+ - audit_rules_login_events_tallylog -+ - audit_rules_mac_modification -+ - audit_rules_media_export -+ - audit_rules_networkconfig_modification -+ - audit_rules_privileged_commands_chage -+ - audit_rules_privileged_commands_chsh -+ - audit_rules_privileged_commands_crontab -+ - audit_rules_privileged_commands_gpasswd -+ - audit_rules_privileged_commands_newgrp -+ - audit_rules_privileged_commands_pam_timestamp_check -+ - audit_rules_privileged_commands_passwd -+ - audit_rules_privileged_commands_postdrop -+ - audit_rules_privileged_commands_postqueue -+ - audit_rules_privileged_commands_ssh_keysign -+ - audit_rules_privileged_commands_sudoedit -+ - audit_rules_privileged_commands_umount -+ - audit_rules_privileged_commands_unix_chkpwd -+ - audit_rules_privileged_commands_userhelper -+ - audit_rules_session_events -+ - audit_rules_sysadmin_actions -+ - audit_rules_system_shutdown -+ - audit_rules_time_adjtimex -+ - audit_rules_time_clock_settime -+ - audit_rules_time_settimeofday -+ - audit_rules_time_stime -+ - audit_rules_time_watch_localtime -+ - audit_rules_unsuccessful_file_modification_creat -+ - audit_rules_unsuccessful_file_modification_ftruncate -+ - audit_rules_unsuccessful_file_modification_openat -+ - audit_rules_unsuccessful_file_modification_open_by_handle_at -+ - audit_rules_unsuccessful_file_modification_open -+ - audit_rules_unsuccessful_file_modification_truncate -+ - audit_rules_usergroup_modification_group -+ - audit_rules_usergroup_modification_gshadow -+ - audit_rules_usergroup_modification_opasswd -+ - audit_rules_usergroup_modification_passwd -+ - audit_rules_usergroup_modification_shadow -diff --git a/almalinux8/profiles/ism_o.profile b/almalinux8/profiles/ism_o.profile -new file mode 100644 -index 00000000..bbc6a445 ---- /dev/null -+++ b/almalinux8/profiles/ism_o.profile -@@ -0,0 +1,158 @@ -+documentation_complete: false -+ -+metadata: -+ SMEs: -+ - shaneboulden -+ - wcushen -+ - ahamilto156 -+ -+reference: https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-linux-environments -+ -+title: 'Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) Official' -+ -+description: |- -+ This profile contains configuration checks for AlmaLinux 8 -+ that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) -+ with the Attorney-General’s Department (AGD)’s applicability marking of OFFICIAL. -+ -+ A overview and list of Cyber security guidelines of the -+ Information Security Manual can be found at the ACSC website: -+ -+ https://www.cyber.gov.au/ism -+ -+extends: e8 -+ -+selections: -+ -+ ## Operating system configuration -+ ## Identifiers 1491 -+ - no_shelllogin_for_systemaccounts -+ -+ ## Local administrator accounts -+ ## Identifiers 1410 -+ - accounts_password_all_shadowed -+ -+ ## Content filtering & Anti virus -+ ## Identifiers 1341 / 1034 / 1417 / 1288 -+ - package_aide_installed -+ -+ ## Software firewall -+ ## Identifiers 1416 -+ - configure_firewalld_ports -+ ## Removing due to build error -+ ## - configure_firewalld_rate_limiting -+ - firewalld_sshd_port_enabled -+ - set_firewalld_default_zone -+ -+ ## Endpoint device control software -+ ## Identifiers 1418 -+ - package_usbguard_installed -+ - service_usbguard_enabled -+ -+ ## Authentication hardening -+ ## Identifiers 1546 / 0974 / 1173 / 1504 / 1505 / 1401 / 1559 / 1560 -+ ## 1561 / 0421 / 1557 / 0422 / 1558 / 1403 / 0431 -+ - disable_host_auth -+ - require_emergency_target_auth -+ - require_singleuser_auth -+ - sebool_authlogin_nsswitch_use_ldap -+ - sebool_authlogin_radius -+ - sshd_disable_kerb_auth -+ - sshd_set_max_auth_tries -+ - sssd_enable_smartcards -+ - accounts_password_minlen_login_defs -+ - var_password_pam_minlen=14 -+ - accounts_password_pam_minlen -+ - accounts_password_pam_minclass -+ - accounts_password_pam_dcredit -+ - accounts_password_pam_lcredit -+ - accounts_password_pam_ocredit -+ - accounts_password_pam_ucredit -+ - accounts_password_pam_maxrepeat -+ - accounts_passwords_pam_faillock_deny -+ - accounts_passwords_pam_faillock_deny_root -+ - accounts_passwords_pam_faillock_interval -+ - accounts_passwords_pam_faillock_unlock_time -+ -+ ## Password authentication & Protecting credentials -+ ## Identifiers 1055 / 0418 / 1402 -+ - network_nmcli_permissions -+ - configure_kerberos_crypto_policy -+ - kerberos_disable_no_keytab -+ - sebool_kerberos_enabled -+ - sshd_disable_gssapi_auth -+ - enable_ldap_client -+ - set_password_hashing_algorithm_libuserconf -+ - set_password_hashing_algorithm_logindefs -+ - set_password_hashing_algorithm_systemauth -+ - accounts_password_warn_age_login_defs -+ - accounts_maximum_age_login_defs -+ - accounts_minimum_age_login_defs -+ -+ ## System administration & MFA -+ ## Identifiers 1382 / 1384 / 1386 -+ - package_sudo_installed -+ - package_opensc_installed -+ - var_smartcard_drivers=cac -+ - configure_opensc_card_drivers -+ - force_opensc_card_drivers -+ - package_pcsc-lite_installed -+ - service_pcscd_enabled -+ - sssd_enable_smartcards -+ -+ ## System patching & Applicatoin versions -+ ## Identifiers 1493 / 1144 / 0940 / 1472 / 1494 / 1495 / 1467 / 1483 -+ - dnf-automatic_apply_updates -+ - package_dnf-plugin-subscription-manager_installed -+ - package_subscription-manager_installed -+ -+ ## Centralised logging facility -+ ## Identifiers 1405 / 0988 -+ - rsyslog_cron_logging -+ - rsyslog_files_groupownership -+ - rsyslog_files_ownership -+ - rsyslog_files_permissions -+ - rsyslog_nolisten -+ - rsyslog_remote_loghost -+ - rsyslog_remote_tls -+ - rsyslog_remote_tls_cacert -+ - package_chrony_installed -+ - service_chronyd_enabled -+ - chronyd_or_ntpd_specify_multiple_servers -+ - chronyd_specify_remote_server -+ - service_chronyd_or_ntpd_enabled -+ -+ ## Events to be logged -+ ## Identifiers 0584 / 0582 / 0585 / 0586 / 0846 / 0957 -+ - display_login_attempts -+ - sebool_auditadm_exec_content -+ - audit_rules_privileged_commands -+ - audit_rules_session_events -+ - audit_rules_unsuccessful_file_modification -+ - audit_access_failed -+ - audit_access_success -+ -+ ## Web application & Database servers -+ ## Identifiers 1552 / 1277 -+ - openssl_use_strong_entropy -+ -+ ## Network design and configuration -+ ## Identifiers 1311 -+ - service_snmpd_disabled -+ - snmpd_use_newer_protocol -+ -+ ## Wireless networks -+ ## Identifiers 1315 / 1319 -+ - wireless_disable_interfaces -+ - network_ipv6_static_address -+ -+ ## ASD Approved Cryptopgraphic Algorithims -+ ## Identifiers 1446 -+ - enable_dracut_fips_module -+ - enable_fips_mode -+ - var_system_crypto_policy=fips -+ - configure_crypto_policy -+ -+ ## Secure Shell access -+ ## Identifiers 1506 / 1449 / 0487 -+ - sshd_allow_only_protocol2 -diff --git a/almalinux8/profiles/ospp-mls.profile b/almalinux8/profiles/ospp-mls.profile -new file mode 100644 -index 00000000..d1d1b8af ---- /dev/null -+++ b/almalinux8/profiles/ospp-mls.profile -@@ -0,0 +1,25 @@ -+documentation_complete: false -+ -+title: 'Protection Profile for General Purpose Operating Systems - MLS Mode' -+ -+description: |- -+ Placeholder to put MLS specific rules -+ -+extends: ospp -+ -+selections: -+ -+ ################################################ -+ ## MUST INSTALL PACKAGES IN MLS MODE -+ #cups -+ #foomatic -+ #ghostscript -+ #ghostscript-fonts -+ #checkpolicy -+ #mcstrans -+ #policycoreutils-newrole -+ #selinux-policy-devel -+ ##xinetd -+ #iproute -+ #iputils -+ #netlabel_tools -diff --git a/almalinux8/profiles/ospp.profile b/almalinux8/profiles/ospp.profile -new file mode 100644 -index 00000000..7373086f ---- /dev/null -+++ b/almalinux8/profiles/ospp.profile -@@ -0,0 +1,443 @@ -+documentation_complete: true -+ -+metadata: -+ version: 4.2.1 -+ SMEs: -+ - comps -+ - carlosmmatos -+ - stevegrubb -+ -+reference: https://www.niap-ccevs.org/Profile/PP.cfm -+ -+title: 'Protection Profile for General Purpose Operating Systems' -+ -+description: |- -+ This profile reflects mandatory configuration controls identified in the -+ NIAP Configuration Annex to the Protection Profile for General Purpose -+ Operating Systems (Protection Profile Version 4.2.1). -+ -+ This configuration profile is consistent with CNSSI-1253, which requires -+ U.S. National Security Systems to adhere to certain configuration -+ parameters. Accordingly, this configuration profile is suitable for -+ use in U.S. National Security Systems. -+ -+selections: -+ -+ ####################################################### -+ ### GENERAL REQUIREMENTS -+ ### Things needed to meet OSPP functional requirements. -+ ####################################################### -+ -+ ### Partitioning -+ - mount_option_home_nodev -+ - mount_option_home_nosuid -+ - mount_option_tmp_nodev -+ - mount_option_tmp_noexec -+ - mount_option_tmp_nosuid -+ - mount_option_var_tmp_nodev -+ - mount_option_var_tmp_noexec -+ - mount_option_var_tmp_nosuid -+ - mount_option_dev_shm_nodev -+ - mount_option_dev_shm_noexec -+ - mount_option_dev_shm_nosuid -+ - mount_option_nodev_nonroot_local_partitions -+ - mount_option_boot_nodev -+ - mount_option_boot_nosuid -+ - partition_for_home -+ - partition_for_var -+ - mount_option_var_nodev -+ - partition_for_var_log -+ - mount_option_var_log_nodev -+ - mount_option_var_log_nosuid -+ - mount_option_var_log_noexec -+ - partition_for_var_log_audit -+ - mount_option_var_log_audit_nodev -+ - mount_option_var_log_audit_nosuid -+ - mount_option_var_log_audit_noexec -+ -+ ### Services -+ # sshd -+ - sshd_disable_root_login -+ - sshd_enable_strictmodes -+ - disable_host_auth -+ - sshd_disable_empty_passwords -+ - sshd_disable_kerb_auth -+ - sshd_disable_gssapi_auth -+ - sshd_set_keepalive -+ - sshd_enable_warning_banner -+ - sshd_rekey_limit -+ - var_rekey_limit_size=1G -+ - var_rekey_limit_time=1hour -+ - sshd_use_strong_rng -+ - openssl_use_strong_entropy -+ -+ # Time Server -+ - chronyd_client_only -+ - chronyd_no_chronyc_network -+ -+ ### Network Settings -+ - sysctl_net_ipv6_conf_all_accept_ra -+ - sysctl_net_ipv6_conf_default_accept_ra -+ - sysctl_net_ipv4_conf_all_accept_redirects -+ - sysctl_net_ipv4_conf_default_accept_redirects -+ - sysctl_net_ipv6_conf_all_accept_redirects -+ - sysctl_net_ipv6_conf_default_accept_redirects -+ - sysctl_net_ipv4_conf_all_accept_source_route -+ - sysctl_net_ipv4_conf_default_accept_source_route -+ - sysctl_net_ipv6_conf_all_accept_source_route -+ - sysctl_net_ipv6_conf_default_accept_source_route -+ - sysctl_net_ipv4_conf_all_secure_redirects -+ - sysctl_net_ipv4_conf_default_secure_redirects -+ - sysctl_net_ipv4_conf_all_send_redirects -+ - sysctl_net_ipv4_conf_default_send_redirects -+ - sysctl_net_ipv4_conf_all_log_martians -+ - sysctl_net_ipv4_conf_default_log_martians -+ - sysctl_net_ipv4_conf_all_rp_filter -+ - sysctl_net_ipv4_conf_default_rp_filter -+ - sysctl_net_ipv4_icmp_ignore_bogus_error_responses -+ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts -+ - sysctl_net_ipv4_ip_forward -+ - sysctl_net_ipv4_tcp_syncookies -+ -+ ### systemd -+ - disable_ctrlaltdel_reboot -+ - disable_ctrlaltdel_burstaction -+ - service_debug-shell_disabled -+ -+ ### umask -+ - var_accounts_user_umask=027 -+ - accounts_umask_etc_profile -+ - accounts_umask_etc_bashrc -+ - accounts_umask_etc_csh_cshrc -+ -+ ### Software update -+ - ensure_almalinux_gpgkey_installed -+ - ensure_gpgcheck_globally_activated -+ - ensure_gpgcheck_local_packages -+ - ensure_gpgcheck_never_disabled -+ -+ ### Passwords -+ - var_password_pam_difok=4 -+ - accounts_password_pam_difok -+ - var_password_pam_maxrepeat=3 -+ - accounts_password_pam_maxrepeat -+ - var_password_pam_maxclassrepeat=4 -+ - accounts_password_pam_maxclassrepeat -+ -+ ### Kernel Config -+ ## Boot prompt -+ - grub2_audit_argument -+ - grub2_audit_backlog_limit_argument -+ - grub2_slub_debug_argument -+ - grub2_page_poison_argument -+ - grub2_vsyscall_argument -+ - grub2_vsyscall_argument.role=unscored -+ - grub2_vsyscall_argument.severity=info -+ - grub2_pti_argument -+ - grub2_kernel_trust_cpu_rng -+ -+ ## Security Settings -+ - sysctl_kernel_kptr_restrict -+ - sysctl_kernel_dmesg_restrict -+ - sysctl_kernel_kexec_load_disabled -+ - sysctl_kernel_yama_ptrace_scope -+ - sysctl_kernel_perf_event_paranoid -+ - sysctl_user_max_user_namespaces -+ - sysctl_user_max_user_namespaces.role=unscored -+ - sysctl_user_max_user_namespaces.severity=info -+ - sysctl_kernel_unprivileged_bpf_disabled -+ - sysctl_net_core_bpf_jit_harden -+ - service_kdump_disabled -+ -+ ## File System Settings -+ - sysctl_fs_protected_hardlinks -+ - sysctl_fs_protected_symlinks -+ -+ ### Audit -+ - service_auditd_enabled -+ - var_auditd_flush=incremental_async -+ - auditd_data_retention_flush -+ - auditd_local_events -+ - auditd_write_logs -+ - auditd_log_format -+ - auditd_freq -+ - auditd_name_format -+ -+ ### Module Blacklist -+ - kernel_module_cramfs_disabled -+ - kernel_module_bluetooth_disabled -+ - kernel_module_sctp_disabled -+ - kernel_module_firewire-core_disabled -+ - kernel_module_atm_disabled -+ - kernel_module_can_disabled -+ - kernel_module_tipc_disabled -+ -+ ### rpcbind -+ -+ ### Install Required Packages -+ - package_aide_installed -+ - package_dnf-automatic_installed -+ - package_subscription-manager_installed -+ - package_dnf-plugin-subscription-manager_installed -+ - package_firewalld_installed -+ - package_openscap-scanner_installed -+ - package_policycoreutils_installed -+ - package_sudo_installed -+ - package_usbguard_installed -+ - package_scap-security-guide_installed -+ - package_audit_installed -+ - package_crypto-policies_installed -+ - package_openssh-server_installed -+ - package_openssh-clients_installed -+ - package_policycoreutils-python-utils_installed -+ - package_rsyslog_installed -+ - package_rsyslog-gnutls_installed -+ - package_audispd-plugins_installed -+ - package_chrony_installed -+ - package_gnutls-utils_installed -+ -+ ### Remove Prohibited Packages -+ - package_sendmail_removed -+ - package_iprutils_removed -+ - package_gssproxy_removed -+ - package_nfs-utils_removed -+ - package_krb5-workstation_removed -+ - package_abrt-addon-kerneloops_removed -+ - package_abrt-addon-python_removed -+ - package_abrt-addon-ccpp_removed -+ - package_abrt-plugin-rhtsupport_removed -+ - package_abrt-plugin-logger_removed -+ - package_abrt-plugin-sosreport_removed -+ - package_abrt-cli_removed -+ - package_abrt_removed -+ -+ ### Login -+ - disable_users_coredumps -+ - sysctl_kernel_core_pattern -+ - coredump_disable_storage -+ - coredump_disable_backtraces -+ - service_systemd-coredump_disabled -+ - var_accounts_max_concurrent_login_sessions=10 -+ - accounts_max_concurrent_login_sessions -+ - securetty_root_login_console_only -+ - var_password_pam_unix_remember=5 -+ - accounts_password_pam_unix_remember -+ - use_pam_wheel_for_su -+ -+ ### SELinux Configuration -+ - var_selinux_state=enforcing -+ - selinux_state -+ - var_selinux_policy_name=targeted -+ - selinux_policytype -+ -+ ### Application Whitelisting (RHEL 8) -+ - package_fapolicyd_installed -+ - service_fapolicyd_enabled -+ -+ ### Configure USBGuard -+ - service_usbguard_enabled -+ - configure_usbguard_auditbackend -+ - usbguard_allow_hid_and_hub -+ -+ -+ ### Enable / Configure FIPS -+ - enable_fips_mode -+ - var_system_crypto_policy=fips_ospp -+ - configure_crypto_policy -+ - configure_ssh_crypto_policy -+ - configure_bind_crypto_policy -+ - configure_openssl_crypto_policy -+ - configure_libreswan_crypto_policy -+ - configure_kerberos_crypto_policy -+ - enable_dracut_fips_module -+ -+ ####################################################### -+ ### CONFIGURATION ANNEX TO THE PROTECTION PROFILE -+ ### FOR GENERAL PURPOSE OPERATING SYSTEMS -+ ### ANNEX RELEASE 1 -+ ### FOR PROTECTION PROFILE VERSIONS 4.2 -+ ### -+ ### https://www.niap-ccevs.org/MMO/PP/-442ConfigAnnex-/ -+ ####################################################### -+ -+ ## Configure Minimum Password Length to 12 Characters -+ ## IA-5 (1)(a) / FMT_MOF_EXT.1 -+ - var_accounts_password_minlen_login_defs=12 -+ - accounts_password_minlen_login_defs -+ - var_password_pam_minlen=12 -+ - accounts_password_pam_minlen -+ -+ ## Require at Least 1 Special Character in Password -+ ## IA-5(1)(a) / FMT_MOF_EXT.1 -+ - var_password_pam_ocredit=1 -+ - accounts_password_pam_ocredit -+ -+ ## Require at Least 1 Numeric Character in Password -+ ## IA-5(1)(a) / FMT_MOF_EXT.1 -+ - var_password_pam_dcredit=1 -+ - accounts_password_pam_dcredit -+ -+ ## Require at Least 1 Uppercase Character in Password -+ ## IA-5(1)(a) / FMT_MOF_EXT.1 -+ - var_password_pam_ucredit=1 -+ - accounts_password_pam_ucredit -+ -+ ## Require at Least 1 Lowercase Character in Password -+ ## IA-5(1)(a) / FMT_MOF_EXT.1 -+ - var_password_pam_lcredit=1 -+ - accounts_password_pam_lcredit -+ -+ ## Enable Screen Lock -+ ## FMT_MOF_EXT.1 -+ - package_tmux_installed -+ - configure_bashrc_exec_tmux -+ - no_tmux_in_shells -+ - configure_tmux_lock_command -+ - configure_tmux_lock_after_time -+ -+ ## Set Screen Lock Timeout Period to 30 Minutes or Less -+ ## AC-11(a) / FMT_MOF_EXT.1 -+ ## We deliberately set sshd timeout to 1 minute before tmux lock timeout -+ - sshd_idle_timeout_value=14_minutes -+ - sshd_set_idle_timeout -+ -+ ## Disable Unauthenticated Login (such as Guest Accounts) -+ ## FIA_UAU.1 -+ - require_singleuser_auth -+ - grub2_disable_interactive_boot -+ - grub2_uefi_password -+ - no_empty_passwords -+ -+ ## Set Maximum Number of Authentication Failures to 3 Within 15 Minutes -+ ## AC-7 / FIA_AFL.1 -+ - var_accounts_passwords_pam_faillock_deny=3 -+ - accounts_passwords_pam_faillock_deny -+ - var_accounts_passwords_pam_faillock_fail_interval=900 -+ - accounts_passwords_pam_faillock_interval -+ - var_accounts_passwords_pam_faillock_unlock_time=never -+ - accounts_passwords_pam_faillock_unlock_time -+ -+ ## Enable Host-Based Firewall -+ ## SC-7(12) / FMT_MOF_EXT.1 -+ - service_firewalld_enabled -+ -+ ## Configure Name/Addres of Remote Management Server -+ ## From Which to Receive Config Settings -+ ## CM-3(3) / FMT_MOF_EXT.1 -+ -+ ## Configure the System to Offload Audit Records to a Log -+ ## Server -+ ## AU-4(1) / FAU_GEN.1.1.c -+ # temporarily dropped -+ -+ ## Set Logon Warning Banner -+ ## AC-8(a) / FMT_MOF_EXT.1 -+ -+ ## Audit All Logons (Success/Failure) and Logoffs (Success) -+ ## CNSSI 1253 Value or DoD-Specific Values: -+ ## (1) Logons (Success/Failure) -+ ## (2) Logoffs (Success) -+ ## AU-2(a) / FAU_GEN.1.1.c -+ -+ ## Audit File and Object Events (Unsuccessful) -+ ## CNSSI 1253 Value or DoD-specific Values: -+ ## (1) Create (Success/Failure) -+ ## (2) Access (Success/Failure) -+ ## (3) Delete (Sucess/Failure) -+ ## (4) Modify (Success/Failure) -+ ## (5) Permission Modification (Sucess/Failure) -+ ## (6) Ownership Modification (Success/Failure) -+ ## AU-2(a) / FAU_GEN.1.1.c -+ ## -+ ## -+ ## (1) Create (Success/Failure) -+ ## (open with O_CREAT) -+ ## (2) Access (Success/Failure) -+ ## (3) Delete (Success/Failure) -+ ## (4) Modify (Success/Failure) -+ ## (5) Permission Modification (Success/Failure) -+ ## (6) Ownership Modification (Success/Failure) -+ -+ ## Audit User and Group Management Events (Success/Failure) -+ ## CNSSI 1253 Value or DoD-specific Values: -+ ## (1) User add, delete, modify, disable, enable (Success/Failure) -+ ## (2) Group/Role add, delete, modify (Success/Failure) -+ ## AU-2(a) / FAU_GEN.1.1.c -+ ## -+ ## Generic User and Group Management Events (Success/Failure) -+ ## Selection of setuid programs that relate to -+ ## user accounts. -+ ## -+ ## CNSSI 1253: (1) User add, delete, modify, disable, enable (Success/Failure) -+ ## -+ ## CNSSI 1252: (2) Group/Role add, delete, modify (Success/Failure) -+ ## -+ ## Audit Privilege or Role Escalation Events (Success/Failure) -+ ## CNSSI 1253 Value or DoD-specific Values: -+ ## - Privilege/Role escalation (Success/Failure) -+ ## AU-2(a) / FAU_GEN.1.1.c -+ ## Audit All Audit and Log Data Accesses (Success/Failure) -+ ## CNSSI 1253 Value or DoD-specific Values: -+ ## - Audit and log data access (Success/Failure) -+ ## AU-2(a) / FAU_GEN.1.1.c -+ ## Audit Cryptographic Verification of Software (Success/Failure) -+ ## CNSSI 1253 Value or DoD-specific Values: -+ ## - Applications (e.g. Firefox, Internet Explorer, MS Office Suite, -+ ## etc) initialization (Success/Failure) -+ ## AU-2(a) / FAU_GEN.1.1.c -+ ## Audit Kernel Module Loading and Unloading Events (Success/Failure) -+ ## AU-2(a) / FAU_GEN.1.1.c -+ - audit_basic_configuration -+ - audit_immutable_login_uids -+ - audit_create_failed -+ - audit_create_success -+ - audit_modify_failed -+ - audit_modify_success -+ - audit_access_failed -+ - audit_access_success -+ - audit_delete_failed -+ - audit_delete_success -+ - audit_perm_change_failed -+ - audit_perm_change_success -+ - audit_owner_change_failed -+ - audit_owner_change_success -+ - audit_ospp_general -+ - audit_module_load -+ -+ ## Enable Automatic Software Updates -+ ## SI-2 / FMT_MOF_EXT.1 -+ # Configure dnf-automatic to Install Only Security Updates -+ - dnf-automatic_security_updates_only -+ -+ # Configure dnf-automatic to Install Available Updates Automatically -+ - dnf-automatic_apply_updates -+ -+ # Enable dnf-automatic Timer -+ - timer_dnf-automatic_enabled -+ -+ # Configure TLS for remote logging -+ - rsyslog_remote_tls -+ - rsyslog_remote_tls_cacert -+ -+ # Prevent Kerberos use by system daemons -+ - kerberos_disable_no_keytab -+ -+ # set ssh client rekey limit -+ - ssh_client_rekey_limit -+ - var_ssh_client_rekey_limit_size=1G -+ - var_ssh_client_rekey_limit_time=1hour -+ -+# configure ssh client to use strong entropy -+ - ssh_client_use_strong_rng_sh -+ - ssh_client_use_strong_rng_csh -+ -+ # zIPl specific rules -+ - zipl_bls_entries_only -+ - zipl_bootmap_is_up_to_date -+ - zipl_audit_argument -+ - zipl_audit_backlog_limit_argument -+ - zipl_slub_debug_argument -+ - zipl_page_poison_argument -+ - zipl_vsyscall_argument -+ - zipl_vsyscall_argument.role=unscored -+ - zipl_vsyscall_argument.severity=info -diff --git a/almalinux8/profiles/pci-dss.profile b/almalinux8/profiles/pci-dss.profile -new file mode 100644 -index 00000000..bbee0d36 ---- /dev/null -+++ b/almalinux8/profiles/pci-dss.profile -@@ -0,0 +1,147 @@ -+documentation_complete: true -+ -+metadata: -+ SMEs: -+ - carlosmmatos -+ -+reference: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf -+ -+title: 'PCI-DSS v3.2.1 Control Baseline for AlmaLinux 8' -+ -+description: |- -+ Ensures PCI-DSS v3.2.1 security configuration settings are applied. -+ -+selections: -+ - var_password_pam_unix_remember=4 -+ - var_account_disable_post_pw_expiration=90 -+ - var_accounts_passwords_pam_faillock_deny=6 -+ - var_accounts_passwords_pam_faillock_unlock_time=1800 -+ - sshd_idle_timeout_value=15_minutes -+ - var_password_pam_minlen=7 -+ - var_password_pam_minclass=2 -+ - var_accounts_maximum_age_login_defs=90 -+ - var_auditd_num_logs=5 -+ - service_auditd_enabled -+ - grub2_audit_argument -+ - auditd_data_retention_num_logs -+ - auditd_data_retention_max_log_file -+ - auditd_data_retention_max_log_file_action -+ - auditd_data_retention_space_left_action -+ - auditd_data_retention_admin_space_left_action -+ - auditd_data_retention_action_mail_acct -+ - package_audispd-plugins_installed -+ - auditd_audispd_syslog_plugin_activated -+ - audit_rules_time_adjtimex -+ - audit_rules_time_settimeofday -+ - audit_rules_time_stime -+ - audit_rules_time_clock_settime -+ - audit_rules_time_watch_localtime -+ - audit_rules_usergroup_modification_group -+ - audit_rules_usergroup_modification_gshadow -+ - audit_rules_usergroup_modification_opasswd -+ - audit_rules_usergroup_modification_passwd -+ - audit_rules_usergroup_modification_shadow -+ - audit_rules_networkconfig_modification -+ - file_permissions_var_log_audit -+ - file_ownership_var_log_audit -+ - audit_rules_mac_modification -+ - audit_rules_dac_modification_chmod -+ - audit_rules_dac_modification_chown -+ - audit_rules_dac_modification_fchmod -+ - audit_rules_dac_modification_fchmodat -+ - audit_rules_dac_modification_fchown -+ - audit_rules_dac_modification_fchownat -+ - audit_rules_dac_modification_fremovexattr -+ - audit_rules_dac_modification_fsetxattr -+ - audit_rules_dac_modification_lchown -+ - audit_rules_dac_modification_lremovexattr -+ - audit_rules_dac_modification_lsetxattr -+ - audit_rules_dac_modification_removexattr -+ - audit_rules_dac_modification_setxattr -+ - audit_rules_login_events -+ - audit_rules_session_events -+ - audit_rules_unsuccessful_file_modification_creat -+ - audit_rules_unsuccessful_file_modification_ftruncate -+ - audit_rules_unsuccessful_file_modification_open -+ - audit_rules_unsuccessful_file_modification_open_by_handle_at -+ - audit_rules_unsuccessful_file_modification_openat -+ - audit_rules_unsuccessful_file_modification_truncate -+ - audit_rules_privileged_commands -+ - audit_rules_media_export -+ - audit_rules_file_deletion_events_rename -+ - audit_rules_file_deletion_events_renameat -+ - audit_rules_file_deletion_events_rmdir -+ - audit_rules_file_deletion_events_unlink -+ - audit_rules_file_deletion_events_unlinkat -+ - audit_rules_sysadmin_actions -+ - audit_rules_kernel_module_loading_delete -+ - audit_rules_kernel_module_loading_finit -+ - audit_rules_kernel_module_loading_init -+ - audit_rules_immutable -+ - var_multiple_time_servers=rhel -+ - service_chronyd_or_ntpd_enabled -+ - chronyd_or_ntpd_specify_remote_server -+ - chronyd_or_ntpd_specify_multiple_servers -+ - rpm_verify_permissions -+ - rpm_verify_hashes -+ - install_hids -+ - rsyslog_files_permissions -+ - rsyslog_files_ownership -+ - rsyslog_files_groupownership -+ - ensure_logrotate_activated -+ - package_aide_installed -+ - aide_build_database -+ - aide_periodic_cron_checking -+ - account_unique_name -+ - gid_passwd_group_same -+ - accounts_password_all_shadowed -+ - no_empty_passwords -+ - display_login_attempts -+ - account_disable_post_pw_expiration -+ - accounts_passwords_pam_faillock_deny -+ - accounts_passwords_pam_faillock_unlock_time -+ - dconf_db_up_to_date -+ - dconf_gnome_screensaver_idle_delay -+ - dconf_gnome_screensaver_idle_activation_enabled -+ - dconf_gnome_screensaver_lock_enabled -+ - dconf_gnome_screensaver_mode_blank -+ - sshd_set_idle_timeout -+ - sshd_set_keepalive -+ - accounts_password_pam_minlen -+ - accounts_password_pam_dcredit -+ - accounts_password_pam_ucredit -+ - accounts_password_pam_lcredit -+ - accounts_password_pam_unix_remember -+ - accounts_maximum_age_login_defs -+ - ensure_almalinux_gpgkey_installed -+ - ensure_gpgcheck_globally_activated -+ - ensure_gpgcheck_never_disabled -+ - security_patches_up_to_date -+ - package_opensc_installed -+ - var_smartcard_drivers=cac -+ - configure_opensc_card_drivers -+ - force_opensc_card_drivers -+ - package_pcsc-lite_installed -+ - service_pcscd_enabled -+ - sssd_enable_smartcards -+ - set_password_hashing_algorithm_systemauth -+ - set_password_hashing_algorithm_logindefs -+ - set_password_hashing_algorithm_libuserconf -+ - file_owner_etc_shadow -+ - file_groupowner_etc_shadow -+ - file_permissions_etc_shadow -+ - file_owner_etc_group -+ - file_groupowner_etc_group -+ - file_permissions_etc_group -+ - file_owner_etc_passwd -+ - file_groupowner_etc_passwd -+ - file_permissions_etc_passwd -+ - file_owner_grub2_cfg -+ - file_groupowner_grub2_cfg -+ - package_libreswan_installed -+ - configure_crypto_policy -+ - configure_bind_crypto_policy -+ - configure_openssl_crypto_policy -+ - configure_libreswan_crypto_policy -+ - configure_ssh_crypto_policy -+ - configure_kerberos_crypto_policy -diff --git a/almalinux8/profiles/standard.profile b/almalinux8/profiles/standard.profile -new file mode 100644 -index 00000000..7904d13c ---- /dev/null -+++ b/almalinux8/profiles/standard.profile -@@ -0,0 +1,67 @@ -+documentation_complete: false -+ -+title: 'Standard System Security Profile for AlmaLinux 8' -+ -+description: |- -+ This profile contains rules to ensure standard security baseline -+ of a AlmaLinux 8 system. Regardless of your system's workload -+ all of these checks should pass. -+ -+selections: -+ - ensure_almalinux_gpgkey_installed -+ - ensure_gpgcheck_globally_activated -+ - rpm_verify_permissions -+ - rpm_verify_hashes -+ - security_patches_up_to_date -+ - no_empty_passwords -+ - file_permissions_unauthorized_sgid -+ - file_permissions_unauthorized_suid -+ - file_permissions_unauthorized_world_writable -+ - accounts_root_path_dirs_no_write -+ - dir_perms_world_writable_sticky_bits -+ - mount_option_dev_shm_nodev -+ - mount_option_dev_shm_nosuid -+ - partition_for_var_log -+ - partition_for_var_log_audit -+ - package_rsyslog_installed -+ - service_rsyslog_enabled -+ - audit_rules_time_adjtimex -+ - audit_rules_time_settimeofday -+ - audit_rules_time_stime -+ - audit_rules_time_clock_settime -+ - audit_rules_time_watch_localtime -+ - audit_rules_usergroup_modification -+ - audit_rules_networkconfig_modification -+ - audit_rules_mac_modification -+ - audit_rules_dac_modification_chmod -+ - audit_rules_dac_modification_chown -+ - audit_rules_dac_modification_fchmod -+ - audit_rules_dac_modification_fchmodat -+ - audit_rules_dac_modification_fchown -+ - audit_rules_dac_modification_fchownat -+ - audit_rules_dac_modification_fremovexattr -+ - audit_rules_dac_modification_fsetxattr -+ - audit_rules_dac_modification_lchown -+ - audit_rules_dac_modification_lremovexattr -+ - audit_rules_dac_modification_lsetxattr -+ - audit_rules_dac_modification_removexattr -+ - audit_rules_dac_modification_setxattr -+ - audit_rules_unsuccessful_file_modification -+ - audit_rules_privileged_commands -+ - audit_rules_media_export -+ - audit_rules_file_deletion_events -+ - audit_rules_sysadmin_actions -+ - audit_rules_kernel_module_loading -+ - service_abrtd_disabled -+ - service_atd_disabled -+ - service_autofs_disabled -+ - service_ntpdate_disabled -+ - service_oddjobd_disabled -+ - service_qpidd_disabled -+ - service_rdisc_disabled -+ - configure_crypto_policy -+ - configure_bind_crypto_policy -+ - configure_openssl_crypto_policy -+ - configure_libreswan_crypto_policy -+ - configure_ssh_crypto_policy -+ - configure_kerberos_crypto_policy -diff --git a/almalinux8/profiles/stig.profile b/almalinux8/profiles/stig.profile -new file mode 100644 -index 00000000..8093204c ---- /dev/null -+++ b/almalinux8/profiles/stig.profile -@@ -0,0 +1,328 @@ -+documentation_complete: true -+ -+metadata: -+ version: V1R1 -+ SMEs: -+ - carlosmmatos -+ -+reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux -+ -+title: 'DISA STIG for AlmaLinux 8' -+ -+description: |- -+ This profile contains configuration checks that align to the -+ DISA STIG for AlmaLinux 8. -+ -+selections: -+ # variables -+ - var_rekey_limit_size=1G -+ - var_rekey_limit_time=1hour -+ - var_accounts_user_umask=077 -+ - var_password_pam_difok=8 -+ - var_password_pam_maxrepeat=3 -+ - var_sshd_disable_compression=no -+ - var_password_pam_maxclassrepeat=4 -+ - var_password_pam_minclass=4 -+ - var_accounts_minimum_age_login_defs=1 -+ - var_accounts_max_concurrent_login_sessions=10 -+ - var_password_pam_unix_remember=5 -+ - var_selinux_state=enforcing -+ - var_selinux_policy_name=targeted -+ - var_accounts_password_minlen_login_defs=15 -+ - var_password_pam_minlen=15 -+ - var_password_pam_ocredit=1 -+ - var_password_pam_dcredit=1 -+ - var_password_pam_ucredit=1 -+ - var_password_pam_lcredit=1 -+ - var_password_pam_retry=3 -+ - var_password_pam_minlen=15 -+ - sshd_idle_timeout_value=10_minutes -+ - var_accounts_passwords_pam_faillock_deny=3 -+ - var_accounts_passwords_pam_faillock_fail_interval=900 -+ - var_accounts_passwords_pam_faillock_unlock_time=never -+ - var_ssh_client_rekey_limit_size=1G -+ - var_ssh_client_rekey_limit_time=1hour -+ - var_accounts_fail_delay=4 -+ - var_account_disable_post_pw_expiration=35 -+ - var_auditd_action_mail_acct=root -+ - var_time_service_set_maxpoll=18_hours -+ - var_password_hashing_algorithm=SHA512 -+ - var_accounts_maximum_age_login_defs=60 -+ - var_auditd_space_left=250MB -+ - var_auditd_space_left_action=email -+ - var_auditd_disk_error_action=halt -+ - var_auditd_max_log_file_action=syslog -+ - var_auditd_disk_full_action=halt -+ -+ ### Enable / Configure FIPS -+ - enable_fips_mode -+ - var_system_crypto_policy=fips -+ - configure_crypto_policy -+ - configure_ssh_crypto_policy -+ - configure_bind_crypto_policy -+ - configure_openssl_crypto_policy -+ - configure_libreswan_crypto_policy -+ - configure_kerberos_crypto_policy -+ - enable_dracut_fips_module -+ -+ # rules -+ - installed_OS_is_vendor_supported -+ - security_patches_up_to_date -+ -+ - sysctl_crypto_fips_enabled -+ - encrypt_partitions -+ - sshd_enable_warning_banner -+ - dconf_gnome_banner_enabled -+ - dconf_gnome_login_banner_text -+ - banner_etc_issue -+ - set_password_hashing_algorithm_logindefs -+ - grub2_uefi_password -+ - grub2_uefi_admin_username -+ - grub2_password -+ - grub2_admin_username -+ - kerberos_disable_no_keytab -+ - package_krb5-workstation_removed -+ - selinux_state -+ - package_policycoreutils_installed -+ - sshd_set_idle_timeout -+ - sshd_set_keepalive -+ - sshd_use_strong_rng -+ - file_permissions_binary_dirs -+ - file_ownership_binary_dirs -+ - file_permissions_library_dirs -+ - file_ownership_library_dirs -+ - ensure_gpgcheck_globally_activated -+ - ensure_gpgcheck_local_packages -+ - sysctl_kernel_kexec_load_disabled -+ - sysctl_fs_protected_symlinks -+ - sysctl_fs_protected_hardlinks -+ - sysctl_kernel_dmesg_restrict -+ - sysctl_kernel_perf_event_paranoid -+ - sudo_remove_nopasswd -+ - sudo_remove_no_authenticate -+ - package_opensc_installed -+ - grub2_page_poison_argument -+ - grub2_vsyscall_argument -+ - grub2_slub_debug_argument -+ - sysctl_kernel_randomize_va_space -+ - clean_components_post_updating -+ - selinux_policytype -+ - no_host_based_files -+ - no_user_host_based_files -+ - service_rngd_enabled -+ - package_rng-tools_installed -+ - file_permissions_sshd_pub_key -+ - file_permissions_sshd_private_key -+ - sshd_enable_strictmodes -+ - sshd_disable_compression -+ - sshd_disable_user_known_hosts -+ - partition_for_var -+ - partition_for_var_log -+ - partition_for_var_log_audit -+ - partition_for_tmp -+ - sshd_disable_root_login -+ - service_auditd_enabled -+ - service_rsyslog_enabled -+ - mount_option_home_nosuid -+ - mount_option_boot_nosuid -+ - mount_option_nodev_nonroot_local_partitions -+ - mount_option_nodev_removable_partitions -+ - mount_option_noexec_removable_partitions -+ - mount_option_nosuid_removable_partitions -+ - mount_option_noexec_remote_filesystems -+ - mount_option_nodev_remote_filesystems -+ - mount_option_nosuid_remote_filesystems -+ - service_kdump_disabled -+ - sysctl_kernel_core_pattern -+ - service_systemd-coredump_disabled -+ - disable_users_coredumps -+ - coredump_disable_storage -+ - coredump_disable_backtraces -+ - accounts_user_home_paths_only -+ - accounts_user_interactive_home_directory_defined -+ - file_permissions_home_directories -+ - file_groupownership_home_directories -+ - accounts_user_interactive_home_directory_exists -+ - accounts_have_homedir_login_defs -+ - file_permission_user_init_files -+ - no_files_unowned_by_user -+ - file_permissions_ungroupowned -+ - partition_for_home -+ - gnome_gdm_disable_automatic_login -+ - sshd_do_not_permit_user_env -+ - account_temp_expire_date -+ - accounts_passwords_pam_faillock_deny -+ - accounts_passwords_pam_faillock_interval -+ - accounts_passwords_pam_faillock_unlock_time -+ - accounts_passwords_pam_faillock_deny_root -+ - accounts_max_concurrent_login_sessions -+ - dconf_gnome_screensaver_lock_enabled -+ - configure_bashrc_exec_tmux -+ - no_tmux_in_shells -+ - dconf_gnome_screensaver_idle_delay -+ - configure_tmux_lock_after_time -+ - accounts_password_pam_ucredit -+ - accounts_password_pam_lcredit -+ - accounts_password_pam_dcredit -+ - accounts_password_pam_maxclassrepeat -+ - accounts_password_pam_maxrepeat -+ - accounts_password_pam_minclass -+ - accounts_password_pam_difok -+ - accounts_password_set_min_life_existing -+ - accounts_minimum_age_login_defs -+ - accounts_maximum_age_login_defs -+ - accounts_password_set_max_life_existing -+ - accounts_password_pam_unix_remember -+ - accounts_password_pam_minlen -+ - accounts_password_minlen_login_defs -+ - account_disable_post_pw_expiration -+ - accounts_password_pam_ocredit -+ - sssd_offline_cred_expiration -+ - accounts_logon_fail_delay -+ - display_login_attempts -+ - sshd_print_last_log -+ - accounts_umask_etc_login_defs -+ - accounts_umask_interactive_users -+ - accounts_umask_etc_bashrc -+ - rsyslog_cron_logging -+ - auditd_data_retention_action_mail_acct -+ - postfix_client_configure_mail_alias -+ - auditd_data_disk_error_action -+ - auditd_data_retention_max_log_file_action -+ - auditd_data_disk_full_action -+ - auditd_local_events -+ - auditd_name_format -+ - auditd_log_format -+ - file_permissions_var_log_audit -+ - directory_permissions_var_log_audit -+ # - audit_rules_immutable -+ # - audit_immutable_login_uids -+ # - audit_rules_usergroup_modification_shadow -+ # - audit_rules_usergroup_modification_opasswd -+ # - audit_rules_usergroup_modification_passwd -+ # - audit_rules_usergroup_modification_gshadow -+ # - audit_rules_usergroup_modification_group -+ # - audit_rules_login_events_lastlog -+ - grub2_audit_argument -+ - grub2_audit_backlog_limit_argument -+ - configure_usbguard_auditbackend -+ - package_rsyslog_installed -+ - package_rsyslog-gnutls_installed -+ - rsyslog_remote_loghost -+ # this rule expects configuration in MB instead percentage as how STIG demands -+ # - auditd_data_retention_space_left -+ - auditd_data_retention_space_left_action -+ # remediation fails because default configuration file contains pool instead of server keyword -+ - chronyd_or_ntpd_set_maxpoll -+ - chronyd_client_only -+ - chronyd_no_chronyc_network -+ - package_telnet-server_removed -+ - package_abrt_removed -+ - package_abrt-addon-ccpp_removed -+ - package_abrt-addon-kerneloops_removed -+ - package_abrt-addon-python_removed -+ - package_abrt-cli_removed -+ - package_abrt-plugin-logger_removed -+ - package_abrt-plugin-rhtsupport_removed -+ - package_abrt-plugin-sosreport_removed -+ - package_sendmail_removed -+ # - package_gssproxy_removed -+ - grub2_pti_argument -+ - package_rsh-server_removed -+ - kernel_module_atm_disabled -+ - kernel_module_can_disabled -+ - kernel_module_sctp_disabled -+ - kernel_module_tipc_disabled -+ - kernel_module_cramfs_disabled -+ - kernel_module_firewire-core_disabled -+ - configure_firewalld_ports -+ - service_autofs_disabled -+ - kernel_module_usb-storage_disabled -+ - service_firewalld_enabled -+ - package_firewalld_installed -+ - wireless_disable_interfaces -+ - kernel_module_bluetooth_disabled -+ - mount_option_dev_shm_nodev -+ - mount_option_dev_shm_nosuid -+ - mount_option_dev_shm_noexec -+ - mount_option_tmp_nodev -+ - mount_option_tmp_nosuid -+ - mount_option_tmp_noexec -+ - mount_option_var_log_nodev -+ - mount_option_var_log_nosuid -+ - mount_option_var_log_noexec -+ - mount_option_var_log_audit_nodev -+ - mount_option_var_log_audit_nosuid -+ - mount_option_var_log_audit_noexec -+ - mount_option_var_tmp_nodev -+ - mount_option_var_tmp_nosuid -+ - mount_option_var_tmp_noexec -+ - package_openssh-server_installed -+ - service_sshd_enabled -+ - sshd_rekey_limit -+ - ssh_client_rekey_limit -+ - disable_ctrlaltdel_reboot -+ - dconf_gnome_disable_ctrlaltdel_reboot -+ - disable_ctrlaltdel_burstaction -+ - service_debug-shell_disabled -+ - package_tftp-server_removed -+ - accounts_no_uid_except_zero -+ - sysctl_net_ipv4_conf_default_accept_redirects -+ - sysctl_net_ipv6_conf_default_accept_redirects -+ - sysctl_net_ipv4_conf_all_send_redirects -+ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts -+ - sysctl_net_ipv4_conf_all_accept_source_route -+ - sysctl_net_ipv6_conf_all_accept_source_route -+ - sysctl_net_ipv4_conf_default_accept_source_route -+ - sysctl_net_ipv6_conf_default_accept_source_route -+ - sysctl_net_ipv4_ip_forward -+ - sysctl_net_ipv6_conf_all_accept_ra -+ - sysctl_net_ipv6_conf_default_accept_ra -+ - sysctl_net_ipv4_conf_default_send_redirects -+ - sysctl_net_ipv4_conf_all_accept_redirects -+ - sysctl_net_ipv6_conf_all_accept_redirects -+ - sysctl_kernel_unprivileged_bpf_disabled -+ - sysctl_kernel_yama_ptrace_scope -+ - sysctl_kernel_kptr_restrict -+ - sysctl_user_max_user_namespaces -+ - sysctl_net_ipv4_conf_all_rp_filter -+ # /etc/postfix/main.cf does not exist on default installation resulting in error during remediation -+ # there needs to be a new platform check to identify when postfix is installed or not -+ # - postfix_prevent_unrestricted_relay -+ - aide_verify_ext_attributes -+ - aide_verify_acls -+ # - package_xorg-x11-server-common_removed -+ - sshd_disable_x11_forwarding -+ - sshd_x11_use_localhost -+ - tftpd_uses_secure_mode -+ - package_vsftpd_removed -+ - package_iprutils_removed -+ - package_tuned_removed -+ - require_emergency_target_auth -+ - require_singleuser_auth -+ - set_password_hashing_algorithm_systemauth -+ - dir_perms_world_writable_sticky_bits -+ - package_aide_installed -+ - aide_scan_notification -+ - install_smartcard_packages -+ - sshd_disable_kerb_auth -+ - sshd_disable_gssapi_auth -+ - accounts_user_dot_no_world_writable_programs -+ - network_configure_name_resolution -+ - dir_perms_world_writable_root_owned -+ - package_tmux_installed -+ - configure_tmux_lock_command -+ - accounts_password_pam_retry -+ - sssd_enable_smartcards -+ - no_empty_passwords -+ - sshd_disable_empty_passwords -+ - file_ownership_var_log_audit -+ # - audit_rules_sysadmin_actions -+ - package_audit_installed -+ - service_auditd_enabled -+ - sshd_allow_only_protocol2 -+ - package_fapolicyd_installed -+ - service_fapolicyd_enabled -+ - package_usbguard_installed -+ - service_usbguard_enabled -+ - network_sniffer_disabled -diff --git a/almalinux8/transforms/cci2html.xsl b/almalinux8/transforms/cci2html.xsl -new file mode 100644 -index 00000000..59d708ad ---- /dev/null -+++ b/almalinux8/transforms/cci2html.xsl -@@ -0,0 +1,6 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cci="https://public.cyber.mil/stigs/cci"> -+ -+<xsl:include href="../../shared/transforms/shared_cci2html.xsl"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/constants.xslt b/almalinux8/transforms/constants.xslt -new file mode 100644 -index 00000000..35d34c80 ---- /dev/null -+++ b/almalinux8/transforms/constants.xslt -@@ -0,0 +1,21 @@ -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> -+ -+<xsl:include href="../../shared/transforms/shared_constants.xslt"/> -+ -+<xsl:variable name="product_long_name">AlmaLinux 8</xsl:variable> -+<xsl:variable name="product_short_name">AL8</xsl:variable> -+<xsl:variable name="product_stig_id_name">>AL_8_STIG</xsl:variable> -+<xsl:variable name="prod_type">almalinux8</xsl:variable> -+ -+<xsl:variable name="cisuri">empty</xsl:variable> -+<xsl:variable name="product_guide_id_name">AL-8</xsl:variable> -+<xsl:variable name="disa-stigs-uri" select="$disa-stigs-os-unix-linux-uri"/> -+<xsl:variable name="disa-srguri" select="$disa-ossrguri"/> -+ -+<!-- Define URI for custom CCE identifier which can be used for mapping to corporate policy --> -+<!--xsl:variable name="custom-cce-uri">https://www.example.org</xsl:variable--> -+ -+<!-- Define URI for custom policy reference which can be used for linking to corporate policy --> -+<!--xsl:variable name="custom-ref-uri">https://www.example.org</xsl:variable--> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/shorthand2xccdf.xslt b/almalinux8/transforms/shorthand2xccdf.xslt -new file mode 100644 -index 00000000..e017cf6f ---- /dev/null -+++ b/almalinux8/transforms/shorthand2xccdf.xslt -@@ -0,0 +1,8 @@ -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> -+ -+<xsl:import href="../../shared/transforms/shared_shorthand2xccdf.xslt"/> -+ -+<xsl:include href="constants.xslt"/> -+<xsl:param name="ssg_version">unknown</xsl:param> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/table-add-srgitems.xslt b/almalinux8/transforms/table-add-srgitems.xslt -new file mode 100644 -index 00000000..0212f13d ---- /dev/null -+++ b/almalinux8/transforms/table-add-srgitems.xslt -@@ -0,0 +1,7 @@ -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:cci="https://public.cyber.mil/stigs/cci"> -+ -+<xsl:include href="../../shared/transforms/shared_table-add-srgitems.xslt"/> -+<xsl:variable name="srgtable" select="document('../output/table-almalinux8-srgmap-flat.xhtml')/html/body/table" /> -+<xsl:variable name="cci_list" select="document('../../shared/references/disa-cci-list.xml')/cci:cci_list" /> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/table-sortbyref.xslt b/almalinux8/transforms/table-sortbyref.xslt -new file mode 100644 -index 00000000..bd97ee1c ---- /dev/null -+++ b/almalinux8/transforms/table-sortbyref.xslt -@@ -0,0 +1,6 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_table-sortbyref.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/table-srgmap.xslt b/almalinux8/transforms/table-srgmap.xslt -new file mode 100644 -index 00000000..23c2f60a ---- /dev/null -+++ b/almalinux8/transforms/table-srgmap.xslt -@@ -0,0 +1,11 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:include href="../../shared/transforms/shared_table-srgmap.xslt"/> -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+<xsl:variable name="items" select="document($map-to-items)//*[cdf:reference]" /> -+<xsl:variable name="title" select="document($map-to-items)/cdf:Benchmark/cdf:title" /> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/table-style.xslt b/almalinux8/transforms/table-style.xslt -new file mode 100644 -index 00000000..218d0f75 ---- /dev/null -+++ b/almalinux8/transforms/table-style.xslt -@@ -0,0 +1,5 @@ -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> -+ -+<xsl:import href="../../shared/transforms/shared_table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf-apply-overlay-stig.xslt b/almalinux8/transforms/xccdf-apply-overlay-stig.xslt -new file mode 100644 -index 00000000..38b354af ---- /dev/null -+++ b/almalinux8/transforms/xccdf-apply-overlay-stig.xslt -@@ -0,0 +1,8 @@ -+<?xml version="1.0"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" exclude-result-prefixes="xccdf"> -+ -+<xsl:include href="../../shared/transforms/shared_xccdf-apply-overlay-stig.xslt"/> -+<xsl:include href="constants.xslt"/> -+<xsl:variable name="overlays" select="document($overlay)/xccdf:overlays" /> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2stigformat.xslt b/almalinux8/transforms/xccdf2stigformat.xslt -new file mode 100644 -index 00000000..5421604f ---- /dev/null -+++ b/almalinux8/transforms/xccdf2stigformat.xslt -@@ -0,0 +1,7 @@ -+<?xml version="1.0"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" exclude-result-prefixes="cdf"> -+ -+<xsl:include href="../../shared/transforms/shared_xccdf2stigformat.xslt"/> -+<xsl:include href="constants.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-byref.xslt b/almalinux8/transforms/xccdf2table-byref.xslt -new file mode 100644 -index 00000000..88a53f50 ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-byref.xslt -@@ -0,0 +1,9 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-byref.xslt"/> -+ -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-cce.xslt b/almalinux8/transforms/xccdf2table-cce.xslt -new file mode 100644 -index 00000000..1ffb2221 ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-cce.xslt -@@ -0,0 +1,9 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:cce="http://cce.mitre.org" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-cce.xslt"/> -+ -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-profileanssirefs.xslt b/almalinux8/transforms/xccdf2table-profileanssirefs.xslt -new file mode 100644 -index 00000000..b790974c ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-profileanssirefs.xslt -@@ -0,0 +1,8 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-profileanssirefs.xslt"/> -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-profileccirefs.xslt b/almalinux8/transforms/xccdf2table-profileccirefs.xslt -new file mode 100644 -index 00000000..5a104d95 ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-profileccirefs.xslt -@@ -0,0 +1,9 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:cci="https://public.cyber.mil/stigs/cci" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:ovalns="http://oval.mitre.org/XMLSchema/oval-definitions-5"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-profileccirefs.xslt"/> -+ -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-profilecisrefs.xslt b/almalinux8/transforms/xccdf2table-profilecisrefs.xslt -new file mode 100644 -index 00000000..92cbdf9b ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-profilecisrefs.xslt -@@ -0,0 +1,9 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-profilecisrefs.xslt"/> -+ -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-profilenistrefs-cui.xslt b/almalinux8/transforms/xccdf2table-profilenistrefs-cui.xslt -new file mode 100644 -index 00000000..7596f8b4 ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-profilenistrefs-cui.xslt -@@ -0,0 +1,8 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-profilenistrefs-cui.xslt"/> -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-profilenistrefs.xslt b/almalinux8/transforms/xccdf2table-profilenistrefs.xslt -new file mode 100644 -index 00000000..8e97c333 ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-profilenistrefs.xslt -@@ -0,0 +1,8 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-profilenistrefs.xslt"/> -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> -diff --git a/almalinux8/transforms/xccdf2table-stig.xslt b/almalinux8/transforms/xccdf2table-stig.xslt -new file mode 100644 -index 00000000..2fb56fa7 ---- /dev/null -+++ b/almalinux8/transforms/xccdf2table-stig.xslt -@@ -0,0 +1,9 @@ -+<?xml version="1.0" encoding="utf-8" standalone="yes"?> -+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml"> -+ -+<xsl:import href="../../shared/transforms/shared_xccdf2table-stig.xslt"/> -+ -+<xsl:include href="constants.xslt"/> -+<xsl:include href="table-style.xslt"/> -+ -+</xsl:stylesheet> diff --git a/build_product b/build_product -index 9bf76b4a..98be5bb9 100755 +index 8a186fba..9e03f675 100755 --- a/build_product +++ b/build_product -@@ -268,6 +268,7 @@ set_explict_build_targets() { +@@ -282,6 +282,7 @@ set_explict_build_targets() { # Get this using # grep 'option(SSG_PRODUCT' CMakeLists.txt | sed -e 's/option(SSG_PRODUCT_\(\w\+\).*/\1/' all_cmake_products=( @@ -6363,204 +41,42 @@ index 9bf76b4a..98be5bb9 100755 DEBIAN9 DEBIAN10 diff --git a/controls/anssi.yml b/controls/anssi.yml -index 9e3cf015..96a0467a 100644 +index 7737e67e..d9527752 100644 --- a/controls/anssi.yml +++ b/controls/anssi.yml -@@ -125,7 +125,7 @@ controls: - automated: yes - rules: - - security_patches_up_to_date --{{% if product in ['fedora', 'ol8', 'rhel8'] %}} -+{{% if product in ['fedora', 'ol8', 'rhel8', 'almalinux8'] %}} - - package_dnf-automatic_installed - - timer_dnf-automatic_enabled - # Configure dnf-automatic to Install Available Updates Automatically -@@ -169,7 +169,7 @@ controls: - - id: R12 - level: intermediary - title: Partitioning type -- notes: >- -+ notes: >- - The rule for the /proc file system is not implemented - automated: partially - rules: -@@ -257,7 +257,7 @@ controls: - If the public key of a repository is not installed, the repo is not trusted. - automated: partially - rules: -- - ensure_redhat_gpgkey_installed -+ - ensure_almalinux_gpgkey_installed +@@ -292,7 +292,7 @@ controls: - ensure_gpgcheck_never_disabled - ensure_gpgcheck_globally_activated - ensure_gpgcheck_local_packages -@@ -522,7 +522,7 @@ controls: - - sysctl_kernel_perf_event_max_sample_rate - - sysctl_kernel_perf_cpu_time_max_percent +- - ensure_redhat_gpgkey_installed ++ - ensure_almalinux_gpgkey_installed + - ensure_oracle_gpgkey_installed -- -+ - - id: R24 - level: enhanced - title: Disabling the loading of kernel modules -@@ -750,7 +750,7 @@ controls: - - rsyslog_remote_loghost + - id: R16 +diff --git a/controls/cis_rhel8.yml b/controls/cis_rhel8.yml +index c0d3f5f4..35bf6bd9 100644 +--- a/controls/cis_rhel8.yml ++++ b/controls/cis_rhel8.yml +@@ -283,7 +283,7 @@ controls: + - l1_workstation + automated: no + related_rules: +- - ensure_redhat_gpgkey_installed ++ - ensure_almalinux_gpgkey_installed - # Derived from DAT-NT-012 R12 --{{% if product in ['fedora', 'ol8', 'rhel8'] %}} -+{{% if product in ['fedora', 'ol8', 'rhel8', 'almalinux8'] %}} - - package_rsyslog-gnutls_installed - - rsyslog_remote_tls - - rsyslog_remote_tls_cacert -diff --git a/docs/manual/developer/06_contributing_with_content.md b/docs/manual/developer/06_contributing_with_content.md -index c23a1467..bfc57670 100644 ---- a/docs/manual/developer/06_contributing_with_content.md -+++ b/docs/manual/developer/06_contributing_with_content.md -@@ -771,9 +771,7 @@ means: - > **Important** - > - > The minimum version of Ansible must be at the latest supported --> version. See --> <https://access.redhat.com/support/policy/updates/ansible-engine> for --> information on the supported Ansible versions. -+> version. - - Ansible remediations are either: - -@@ -1805,7 +1803,7 @@ where *LANG* should be the language identifier in lower case, e.g. - 3) Create a file called `template.yml` within the template directory. This file - stores template metadata. Currently, it stores list of supported languages. Note - that each language listed in this file must have associated implementation --file with the *.template* extension, see above. -+file with the *.template* extension, see above. - - An example can look like this: - -diff --git a/docs/manual/developer_guide.adoc b/docs/manual/developer_guide.adoc -index 91ea609b..d2b8a9e2 100644 ---- a/docs/manual/developer_guide.adoc -+++ b/docs/manual/developer_guide.adoc -@@ -1306,7 +1306,7 @@ Remediations also carry metadata that should be present at the beginning of the - - ==== Ansible - --IMPORTANT: The minimum version of Ansible must be at the latest supported version. See https://access.redhat.com/support/policy/updates/ansible-engine for information on the supported Ansible versions. -+IMPORTANT: The minimum version of Ansible must be at the latest supported version. - - Ansible remediations are either: - -@@ -1846,7 +1846,7 @@ _package_installed_ directory: - 2) Create a file called _template.yml_ within the template directory. This file - stores template metadata. Currently, it stores list of supported languages. Note - that each language listed in this file must have associated implementation --file with the _.template_ extension, see above. -+file with the _.template_ extension, see above. - - An example can look like this: - -@@ -1897,7 +1897,7 @@ def preprocess(data, lang): - - ==== Filters - --You can use Jinja macros and Jinja filters in the template code. ComplianceAsCode support all built-in Jinja link:https://jinja.palletsprojects.com/en/2.11.x/templates/#builtin-filters[filters]. -+You can use Jinja macros and Jinja filters in the template code. ComplianceAsCode support all built-in Jinja link:https://jinja.palletsprojects.com/en/2.11.x/templates/#builtin-filters[filters]. - - There are also some custom filters useful for content authoring defined in the project: - -diff --git a/docs/manual/user_guide.adoc b/docs/manual/user_guide.adoc -index 67a1ce87..b45fd4f9 100644 ---- a/docs/manual/user_guide.adoc -+++ b/docs/manual/user_guide.adoc -@@ -261,7 +261,7 @@ yum -y remove xinetd - fi - - # generated: 2013-07-05T13:56:30-04:00 --# END OF SCRIPT -+# END OF SCRIPT - ---- - - This output could be redirected to a bash script, or built into your RHEL7 provisioning process (e.g. the %post section of a kickstart). -@@ -271,7 +271,7 @@ This output could be redirected to a bash script, or built into your RHEL7 provi - ComplianceAsCode embeds ansible remediation scripts into the SCAP content. This allows for SCAP compatible tools to extract these remediation scripts to aide in potential remediation of system misconfigurations. When using OpenSCAP with - Ansible, it is advisable to use the playbooks from https://github.com/RedHatOfficial. These playbooks are generated from the ComplianceAsCode project and are also available on Ansible Galaxy. - --IMPORTANT: The minimum version of Ansible must be at the latest supported version. See https://access.redhat.com/support/policy/updates/ansible-engine for information on the supported Ansible versions. -+IMPORTANT: The minimum version of Ansible must be at the latest supported version. - - ## Content Notes - -@@ -641,4 +641,3 @@ Once the above options are set, return to the SCC main screen by entering 0. - Logs, if any, are located in the following directory: - /opt/scc/Logs - ---- -- -diff --git a/firefox/guide/firefox/installed_firefox_version_supported/rule.yml b/firefox/guide/firefox/installed_firefox_version_supported/rule.yml -index 9f9c0438..239b09ff 100644 ---- a/firefox/guide/firefox/installed_firefox_version_supported/rule.yml -+++ b/firefox/guide/firefox/installed_firefox_version_supported/rule.yml -@@ -3,10 +3,9 @@ documentation_complete: true - title: 'Supported Version of Firefox Installed' - - description: |- -- If the system is joined to the Red Hat Network, a Red Hat Satellite Server, -- or a yum server, run the following command to install updates: -+ If the AlmaLinux repos available, run the following command to install updates: - <pre>$ sudo yum update</pre> -- If the system is not configured to use one of these sources, updates (in the form of RPM packages) -+ If the system is not configured to use repos, updates (in the form of RPM packages) - can be manually downloaded and installed using <tt>rpm</tt>. - - rationale: |- -@@ -25,13 +24,9 @@ references: - ocil_clause: 'it is not updated' - - ocil: |- -- If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or -- a yum server which provides updates, invoking the following command will -+ If the AlmaLinux repos available, invoking the following command will - indicate if updates are available: - <pre>$ sudo yum check-update</pre> -- If the system is not configured to update from one of these sources, -+ If the system is not configured to use repos, - run the following command to list when each package was last updated: - <pre>$ rpm -qa -last</pre> -- Compare this to Red Hat Security Advisories (RHSA) listed at -- {{{ weblink(link="https://access.redhat.com/security/updates/active/") }}} -- to determine if the system is missing applicable updates. -diff --git a/jre/guide/java/java_jre_updated/rule.yml b/jre/guide/java/java_jre_updated/rule.yml -index 80dd2b0d..b9468b59 100644 ---- a/jre/guide/java/java_jre_updated/rule.yml -+++ b/jre/guide/java/java_jre_updated/rule.yml -@@ -3,10 +3,9 @@ documentation_complete: true - title: 'Ensure Java Patches Installed' - - description: |- -- If the system is joined to the Red Hat Network, a Red Hat Satellite Server, -- or a yum server, run the following command to install updates: -+ If the AlmaLinux repos available, run the following command to install updates: - <pre>$ sudo yum update</pre> -- If the system is not configured to use one of these sources, updates (in the form of RPM packages) -+ If the system is not configured to use repos, updates (in the form of RPM packages) - can be manually downloaded and installed using <tt>rpm</tt>. - <br /><br /> - NOTE: U.S. Defense systems are required to be patched within 30 days or sooner as local policy -@@ -27,13 +26,9 @@ references: - ocil_clause: 'it is not updated' - - ocil: |- -- If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or -- a yum server which provides updates, invoking the following command will -+ If the AlmaLinux repos available, invoking the following command will - indicate if updates are available: - <pre>$ sudo yum check-update</pre> -- If the system is not configured to update from one of these sources, -+ If the system is not configured to update from repos, - run the following command to list when each package was last updated: - <pre>$ rpm -qa -last</pre> -- Compare this to Red Hat Security Advisories (RHSA) listed at -- {{{ weblink(link="https://access.redhat.com/security/updates/active/") }}} -- to determine if the system is missing applicable updates. + - id: 1.2.4 + title: Ensure gpgcheck is globally activated (Automated) +@@ -1743,7 +1743,7 @@ controls: + # NEEDS RULE + # The current sshd_enable_warning_banner rule uses /etc/issue instead + # of the /etc/issue.net that the benchmark expects. +- # ++ # + - id: 5.2.15 + title: Ensure SSH warning banner is configured (Automated) + levels: diff --git a/linux_os/guide/services/avahi/avahi_configuration/avahi_check_ttl/rule.yml b/linux_os/guide/services/avahi/avahi_configuration/avahi_check_ttl/rule.yml -index 5b819d0e..ef13f4c8 100644 +index 14ea150a..0f9407b4 100644 --- a/linux_os/guide/services/avahi/avahi_configuration/avahi_check_ttl/rule.yml +++ b/linux_os/guide/services/avahi/avahi_configuration/avahi_check_ttl/rule.yml @@ -1,6 +1,6 @@ @@ -6572,7 +88,7 @@ index 5b819d0e..ef13f4c8 100644 title: 'Check Avahi Responses'' TTL Field' diff --git a/linux_os/guide/services/avahi/avahi_configuration/avahi_ip_only/rule.yml b/linux_os/guide/services/avahi/avahi_configuration/avahi_ip_only/rule.yml -index f0857b6b..8fcbf788 100644 +index 36bb0308..949fda55 100644 --- a/linux_os/guide/services/avahi/avahi_configuration/avahi_ip_only/rule.yml +++ b/linux_os/guide/services/avahi/avahi_configuration/avahi_ip_only/rule.yml @@ -1,6 +1,6 @@ @@ -6584,7 +100,7 @@ index f0857b6b..8fcbf788 100644 title: 'Serve Avahi Only via Required Protocol' diff --git a/linux_os/guide/services/avahi/avahi_configuration/avahi_prevent_port_sharing/rule.yml b/linux_os/guide/services/avahi/avahi_configuration/avahi_prevent_port_sharing/rule.yml -index 24fad07e..ab319bc7 100644 +index 69c83eef..a7d9e163 100644 --- a/linux_os/guide/services/avahi/avahi_configuration/avahi_prevent_port_sharing/rule.yml +++ b/linux_os/guide/services/avahi/avahi_configuration/avahi_prevent_port_sharing/rule.yml @@ -1,6 +1,6 @@ @@ -6596,7 +112,7 @@ index 24fad07e..ab319bc7 100644 title: 'Prevent Other Programs from Using Avahi''s Port' diff --git a/linux_os/guide/services/avahi/avahi_configuration/avahi_restrict_published_information/rule.yml b/linux_os/guide/services/avahi/avahi_configuration/avahi_restrict_published_information/rule.yml -index 9df0b4a8..18067062 100644 +index 0db51bd1..b7cf62ec 100644 --- a/linux_os/guide/services/avahi/avahi_configuration/avahi_restrict_published_information/rule.yml +++ b/linux_os/guide/services/avahi/avahi_configuration/avahi_restrict_published_information/rule.yml @@ -1,6 +1,6 @@ @@ -6608,32 +124,32 @@ index 9df0b4a8..18067062 100644 title: 'Restrict Information Published by Avahi' diff --git a/linux_os/guide/services/avahi/disable_avahi_group/service_avahi-daemon_disabled/rule.yml b/linux_os/guide/services/avahi/disable_avahi_group/service_avahi-daemon_disabled/rule.yml -index f3f08de8..9c3bf646 100644 +index d76a96c7..9375ec19 100644 --- a/linux_os/guide/services/avahi/disable_avahi_group/service_avahi-daemon_disabled/rule.yml +++ b/linux_os/guide/services/avahi/disable_avahi_group/service_avahi-daemon_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,sle15 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Disable Avahi Server Software' diff --git a/linux_os/guide/services/base/package_abrt_removed/rule.yml b/linux_os/guide/services/base/package_abrt_removed/rule.yml -index 03f8a5b6..80977a05 100644 +index e05c15f7..0f37bf27 100644 --- a/linux_os/guide/services/base/package_abrt_removed/rule.yml +++ b/linux_os/guide/services/base/package_abrt_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall Automatic Bug Reporting Tool (abrt)' -@@ -25,7 +25,7 @@ identifiers: - +@@ -27,7 +27,7 @@ identifiers: references: + disa: CCI-000381 srg: SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040001 + stigid@almalinux8: RHEL-08-040001 @@ -6641,7 +157,7 @@ index 03f8a5b6..80977a05 100644 {{{ complete_ocil_entry_package(package="abrt") }}} diff --git a/linux_os/guide/services/base/package_psacct_installed/rule.yml b/linux_os/guide/services/base/package_psacct_installed/rule.yml -index ea782f25..cb15ad27 100644 +index b5a0e717..0b6a33ff 100644 --- a/linux_os/guide/services/base/package_psacct_installed/rule.yml +++ b/linux_os/guide/services/base/package_psacct_installed/rule.yml @@ -1,6 +1,6 @@ @@ -6653,19 +169,19 @@ index ea782f25..cb15ad27 100644 title: 'Install the psacct package' diff --git a/linux_os/guide/services/base/service_abrtd_disabled/rule.yml b/linux_os/guide/services/base/service_abrtd_disabled/rule.yml -index ce181075..87db8aa4 100644 +index d256bd67..cb2d218f 100644 --- a/linux_os/guide/services/base/service_abrtd_disabled/rule.yml +++ b/linux_os/guide/services/base/service_abrtd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Automatic Bug Reporting Tool (abrtd)' diff --git a/linux_os/guide/services/base/service_acpid_disabled/rule.yml b/linux_os/guide/services/base/service_acpid_disabled/rule.yml -index a621333d..a8ce2991 100644 +index cc474092..7a910128 100644 --- a/linux_os/guide/services/base/service_acpid_disabled/rule.yml +++ b/linux_os/guide/services/base/service_acpid_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6677,7 +193,7 @@ index a621333d..a8ce2991 100644 title: 'Disable Advanced Configuration and Power Interface (acpid)' diff --git a/linux_os/guide/services/base/service_certmonger_disabled/rule.yml b/linux_os/guide/services/base/service_certmonger_disabled/rule.yml -index 42439eee..65e2e594 100644 +index 095ff4a2..3cb513e8 100644 --- a/linux_os/guide/services/base/service_certmonger_disabled/rule.yml +++ b/linux_os/guide/services/base/service_certmonger_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6689,7 +205,7 @@ index 42439eee..65e2e594 100644 title: 'Disable Certmonger Service (certmonger)' diff --git a/linux_os/guide/services/base/service_cockpit_disabled/rule.yml b/linux_os/guide/services/base/service_cockpit_disabled/rule.yml -index 29a0739d..fcc9db55 100644 +index 9f84398d..acd7e3c1 100644 --- a/linux_os/guide/services/base/service_cockpit_disabled/rule.yml +++ b/linux_os/guide/services/base/service_cockpit_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6701,7 +217,7 @@ index 29a0739d..fcc9db55 100644 title: 'Disable Cockpit Management Server' diff --git a/linux_os/guide/services/base/service_cpupower_disabled/rule.yml b/linux_os/guide/services/base/service_cpupower_disabled/rule.yml -index fe5078d6..7a00f657 100644 +index 3328abe3..c4221608 100644 --- a/linux_os/guide/services/base/service_cpupower_disabled/rule.yml +++ b/linux_os/guide/services/base/service_cpupower_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6722,28 +238,28 @@ index 1f6a233e..9f3a4d6b 100644 kdump --disable diff --git a/linux_os/guide/services/base/service_kdump_disabled/rule.yml b/linux_os/guide/services/base/service_kdump_disabled/rule.yml -index 86767100..cc578e28 100644 +index ce021c74..91fe4ec4 100644 --- a/linux_os/guide/services/base/service_kdump_disabled/rule.yml +++ b/linux_os/guide/services/base/service_kdump_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable KDump Kernel Crash Analyzer (kdump)' -@@ -39,7 +39,7 @@ references: - iso27001-2013: A.11.2.6,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.2.1,A.6.2.2,A.9.1.2 - cis-csc: 11,12,14,15,3,8,9 - ospp: FMT_SMF_EXT.1.1 +@@ -40,7 +40,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021300 + stigid@rhel7: RHEL-07-021300 - stigid@rhel8: RHEL-08-010670 + stigid@almalinux8: RHEL-08-010670 - - ocil: '{{{ ocil_service_disabled(service="kdump") }}}' - + stigid@sle12: SLES-12-010840 + stigid@sle15: SLES-15-040190 + stigid@ubuntu2004: UBTU-20-010413 diff --git a/linux_os/guide/services/base/service_mdmonitor_disabled/rule.yml b/linux_os/guide/services/base/service_mdmonitor_disabled/rule.yml -index a14cb978..da0c18e8 100644 +index 04a7fb5d..728f96cf 100644 --- a/linux_os/guide/services/base/service_mdmonitor_disabled/rule.yml +++ b/linux_os/guide/services/base/service_mdmonitor_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6755,7 +271,7 @@ index a14cb978..da0c18e8 100644 title: 'Disable Software RAID Monitor (mdmonitor)' diff --git a/linux_os/guide/services/base/service_netconsole_disabled/rule.yml b/linux_os/guide/services/base/service_netconsole_disabled/rule.yml -index 2e32fcf4..b35e3062 100644 +index 19ffe27e..b4231f8b 100644 --- a/linux_os/guide/services/base/service_netconsole_disabled/rule.yml +++ b/linux_os/guide/services/base/service_netconsole_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6767,31 +283,31 @@ index 2e32fcf4..b35e3062 100644 title: 'Disable Network Console (netconsole)' diff --git a/linux_os/guide/services/base/service_ntpdate_disabled/rule.yml b/linux_os/guide/services/base/service_ntpdate_disabled/rule.yml -index 02fd4cc6..328da0cf 100644 +index 12d26e4e..e9b7bdac 100644 --- a/linux_os/guide/services/base/service_ntpdate_disabled/rule.yml +++ b/linux_os/guide/services/base/service_ntpdate_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable ntpdate Service (ntpdate)' diff --git a/linux_os/guide/services/base/service_oddjobd_disabled/rule.yml b/linux_os/guide/services/base/service_oddjobd_disabled/rule.yml -index da8c5865..b1d4befc 100644 +index 77f7e4f4..e68dfa7f 100644 --- a/linux_os/guide/services/base/service_oddjobd_disabled/rule.yml +++ b/linux_os/guide/services/base/service_oddjobd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Odd Job Daemon (oddjobd)' diff --git a/linux_os/guide/services/base/service_portreserve_disabled/rule.yml b/linux_os/guide/services/base/service_portreserve_disabled/rule.yml -index 0ae4f00c..96f05d70 100644 +index fceb228b..3819ac65 100644 --- a/linux_os/guide/services/base/service_portreserve_disabled/rule.yml +++ b/linux_os/guide/services/base/service_portreserve_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6803,7 +319,7 @@ index 0ae4f00c..96f05d70 100644 title: 'Disable Portreserve (portreserve)' diff --git a/linux_os/guide/services/base/service_psacct_enabled/rule.yml b/linux_os/guide/services/base/service_psacct_enabled/rule.yml -index 0c582bda..0dd1c428 100644 +index fa34b99f..a1264aca 100644 --- a/linux_os/guide/services/base/service_psacct_enabled/rule.yml +++ b/linux_os/guide/services/base/service_psacct_enabled/rule.yml @@ -1,6 +1,6 @@ @@ -6815,19 +331,20 @@ index 0c582bda..0dd1c428 100644 title: 'Enable Process Accounting (psacct)' diff --git a/linux_os/guide/services/base/service_qpidd_disabled/rule.yml b/linux_os/guide/services/base/service_qpidd_disabled/rule.yml -index 687a819a..a47a1438 100644 +index ecdd76ec..a87c33b7 100644 --- a/linux_os/guide/services/base/service_qpidd_disabled/rule.yml +++ b/linux_os/guide/services/base/service_qpidd_disabled/rule.yml -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 + # package is unlikely to appear on a RHEL9 system, don't extend to RHEL10 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Apache Qpid (qpidd)' diff --git a/linux_os/guide/services/base/service_quota_nld_disabled/rule.yml b/linux_os/guide/services/base/service_quota_nld_disabled/rule.yml -index cbd83ab7..1b6c1806 100644 +index a04bd5ce..3e9aa353 100644 --- a/linux_os/guide/services/base/service_quota_nld_disabled/rule.yml +++ b/linux_os/guide/services/base/service_quota_nld_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6839,31 +356,31 @@ index cbd83ab7..1b6c1806 100644 title: 'Disable Quota Netlink (quota_nld)' diff --git a/linux_os/guide/services/base/service_rdisc_disabled/rule.yml b/linux_os/guide/services/base/service_rdisc_disabled/rule.yml -index bcfa10d7..3dc3799f 100644 +index 37cc6549..593318ef 100644 --- a/linux_os/guide/services/base/service_rdisc_disabled/rule.yml +++ b/linux_os/guide/services/base/service_rdisc_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Network Router Discovery Daemon (rdisc)' diff --git a/linux_os/guide/services/base/service_rhnsd_disabled/rule.yml b/linux_os/guide/services/base/service_rhnsd_disabled/rule.yml -index a5c78935..22796122 100644 +index c46674a2..c44afdd1 100644 --- a/linux_os/guide/services/base/service_rhnsd_disabled/rule.yml +++ b/linux_os/guide/services/base/service_rhnsd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable Red Hat Network Service (rhnsd)' diff --git a/linux_os/guide/services/base/service_rhsmcertd_disabled/rule.yml b/linux_os/guide/services/base/service_rhsmcertd_disabled/rule.yml -index 3acc9a0c..9e6cc04d 100644 +index 93240d9b..e1ea7a80 100644 --- a/linux_os/guide/services/base/service_rhsmcertd_disabled/rule.yml +++ b/linux_os/guide/services/base/service_rhsmcertd_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6875,7 +392,7 @@ index 3acc9a0c..9e6cc04d 100644 title: 'Disable Red Hat Subscription Manager Daemon (rhsmcertd)' diff --git a/linux_os/guide/services/base/service_saslauthd_disabled/rule.yml b/linux_os/guide/services/base/service_saslauthd_disabled/rule.yml -index a8c48a10..91d70c7c 100644 +index d6409183..f802628e 100644 --- a/linux_os/guide/services/base/service_saslauthd_disabled/rule.yml +++ b/linux_os/guide/services/base/service_saslauthd_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6887,7 +404,7 @@ index a8c48a10..91d70c7c 100644 title: 'Disable Cyrus SASL Authentication Daemon (saslauthd)' diff --git a/linux_os/guide/services/base/service_sysstat_disabled/rule.yml b/linux_os/guide/services/base/service_sysstat_disabled/rule.yml -index 9b396b05..d3b53adb 100644 +index be42e5dd..b3af30ca 100644 --- a/linux_os/guide/services/base/service_sysstat_disabled/rule.yml +++ b/linux_os/guide/services/base/service_sysstat_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -6899,7 +416,7 @@ index 9b396b05..d3b53adb 100644 title: 'Disable System Statistics Reset Service (sysstat)' diff --git a/linux_os/guide/services/cron_and_at/disable_anacron/rule.yml b/linux_os/guide/services/cron_and_at/disable_anacron/rule.yml -index d1a26acf..2b61199d 100644 +index 93206153..0ac567a3 100644 --- a/linux_os/guide/services/cron_and_at/disable_anacron/rule.yml +++ b/linux_os/guide/services/cron_and_at/disable_anacron/rule.yml @@ -1,6 +1,6 @@ @@ -6911,271 +428,271 @@ index d1a26acf..2b61199d 100644 title: 'Disable anacron Service' diff --git a/linux_os/guide/services/cron_and_at/file_groupowner_cron_d/rule.yml b/linux_os/guide/services/cron_and_at/file_groupowner_cron_d/rule.yml -index d7a896ff..6c0628c3 100644 +index 23f77426..2821e287 100644 --- a/linux_os/guide/services/cron_and_at/file_groupowner_cron_d/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_groupowner_cron_d/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Group Who Owns cron.d' diff --git a/linux_os/guide/services/cron_and_at/file_groupowner_cron_daily/rule.yml b/linux_os/guide/services/cron_and_at/file_groupowner_cron_daily/rule.yml -index a3ca2c29..fff0592b 100644 +index 94e31f5e..2937a41c 100644 --- a/linux_os/guide/services/cron_and_at/file_groupowner_cron_daily/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_groupowner_cron_daily/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Group Who Owns cron.daily' diff --git a/linux_os/guide/services/cron_and_at/file_groupowner_cron_hourly/rule.yml b/linux_os/guide/services/cron_and_at/file_groupowner_cron_hourly/rule.yml -index 83811a39..a884eb16 100644 +index f5b9c87f..f60b09b3 100644 --- a/linux_os/guide/services/cron_and_at/file_groupowner_cron_hourly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_groupowner_cron_hourly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Group Who Owns cron.hourly' diff --git a/linux_os/guide/services/cron_and_at/file_groupowner_cron_monthly/rule.yml b/linux_os/guide/services/cron_and_at/file_groupowner_cron_monthly/rule.yml -index addec776..63ed93c2 100644 +index 61f87879..f1fe2e98 100644 --- a/linux_os/guide/services/cron_and_at/file_groupowner_cron_monthly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_groupowner_cron_monthly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Group Who Owns cron.monthly' diff --git a/linux_os/guide/services/cron_and_at/file_groupowner_cron_weekly/rule.yml b/linux_os/guide/services/cron_and_at/file_groupowner_cron_weekly/rule.yml -index 62a78df1..9d9de9f2 100644 +index 35d4324c..827a33e8 100644 --- a/linux_os/guide/services/cron_and_at/file_groupowner_cron_weekly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_groupowner_cron_weekly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Group Who Owns cron.weekly' diff --git a/linux_os/guide/services/cron_and_at/file_groupowner_crontab/rule.yml b/linux_os/guide/services/cron_and_at/file_groupowner_crontab/rule.yml -index 74c10593..ed529289 100644 +index c3986461..dcab852d 100644 --- a/linux_os/guide/services/cron_and_at/file_groupowner_crontab/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_groupowner_crontab/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Group Who Owns Crontab' diff --git a/linux_os/guide/services/cron_and_at/file_owner_cron_d/rule.yml b/linux_os/guide/services/cron_and_at/file_owner_cron_d/rule.yml -index 1f3f68d0..e576f872 100644 +index 2106fc0e..8f823e14 100644 --- a/linux_os/guide/services/cron_and_at/file_owner_cron_d/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_owner_cron_d/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Owner on cron.d' diff --git a/linux_os/guide/services/cron_and_at/file_owner_cron_daily/rule.yml b/linux_os/guide/services/cron_and_at/file_owner_cron_daily/rule.yml -index eec5ce2d..fb70aafb 100644 +index 09f8b220..4ada81e5 100644 --- a/linux_os/guide/services/cron_and_at/file_owner_cron_daily/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_owner_cron_daily/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Owner on cron.daily' diff --git a/linux_os/guide/services/cron_and_at/file_owner_cron_hourly/rule.yml b/linux_os/guide/services/cron_and_at/file_owner_cron_hourly/rule.yml -index 83bd10c8..78da5346 100644 +index ce3210e1..531f5e0b 100644 --- a/linux_os/guide/services/cron_and_at/file_owner_cron_hourly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_owner_cron_hourly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Owner on cron.hourly' diff --git a/linux_os/guide/services/cron_and_at/file_owner_cron_monthly/rule.yml b/linux_os/guide/services/cron_and_at/file_owner_cron_monthly/rule.yml -index d9d6b201..a39b7d17 100644 +index d66eb78e..5f0b15b5 100644 --- a/linux_os/guide/services/cron_and_at/file_owner_cron_monthly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_owner_cron_monthly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Owner on cron.monthly' diff --git a/linux_os/guide/services/cron_and_at/file_owner_cron_weekly/rule.yml b/linux_os/guide/services/cron_and_at/file_owner_cron_weekly/rule.yml -index 5242eebb..af54e05d 100644 +index b29ae87f..fdcff62c 100644 --- a/linux_os/guide/services/cron_and_at/file_owner_cron_weekly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_owner_cron_weekly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Owner on cron.weekly' diff --git a/linux_os/guide/services/cron_and_at/file_owner_crontab/rule.yml b/linux_os/guide/services/cron_and_at/file_owner_crontab/rule.yml -index 6b21ec40..6bd97ce0 100644 +index a28d4fa7..7c901490 100644 --- a/linux_os/guide/services/cron_and_at/file_owner_crontab/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_owner_crontab/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Owner on crontab' diff --git a/linux_os/guide/services/cron_and_at/file_permissions_cron_d/rule.yml b/linux_os/guide/services/cron_and_at/file_permissions_cron_d/rule.yml -index ea2167ed..a8eb6044 100644 +index 7310cfba..f63a83e4 100644 --- a/linux_os/guide/services/cron_and_at/file_permissions_cron_d/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_permissions_cron_d/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Permissions on cron.d' diff --git a/linux_os/guide/services/cron_and_at/file_permissions_cron_daily/rule.yml b/linux_os/guide/services/cron_and_at/file_permissions_cron_daily/rule.yml -index 7592cf9b..11e57aca 100644 +index 69eac888..05e342a2 100644 --- a/linux_os/guide/services/cron_and_at/file_permissions_cron_daily/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_permissions_cron_daily/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Permissions on cron.daily' diff --git a/linux_os/guide/services/cron_and_at/file_permissions_cron_hourly/rule.yml b/linux_os/guide/services/cron_and_at/file_permissions_cron_hourly/rule.yml -index fd7d6cea..9471087d 100644 +index 256f1707..0a85690e 100644 --- a/linux_os/guide/services/cron_and_at/file_permissions_cron_hourly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_permissions_cron_hourly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Permissions on cron.hourly' diff --git a/linux_os/guide/services/cron_and_at/file_permissions_cron_monthly/rule.yml b/linux_os/guide/services/cron_and_at/file_permissions_cron_monthly/rule.yml -index bde17ff1..b7d705ea 100644 +index 7713a468..6df6fcd5 100644 --- a/linux_os/guide/services/cron_and_at/file_permissions_cron_monthly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_permissions_cron_monthly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Permissions on cron.monthly' diff --git a/linux_os/guide/services/cron_and_at/file_permissions_cron_weekly/rule.yml b/linux_os/guide/services/cron_and_at/file_permissions_cron_weekly/rule.yml -index 94fc9508..8f1cafe0 100644 +index c111a154..fc12a722 100644 --- a/linux_os/guide/services/cron_and_at/file_permissions_cron_weekly/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_permissions_cron_weekly/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Permissions on cron.weekly' diff --git a/linux_os/guide/services/cron_and_at/file_permissions_crontab/rule.yml b/linux_os/guide/services/cron_and_at/file_permissions_crontab/rule.yml -index aa013fa7..d34bb711 100644 +index 1cf1d414..6cb9298f 100644 --- a/linux_os/guide/services/cron_and_at/file_permissions_crontab/rule.yml +++ b/linux_os/guide/services/cron_and_at/file_permissions_crontab/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Permissions on crontab' diff --git a/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_groupowner_cron_allow/rule.yml b/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_groupowner_cron_allow/rule.yml -index b1014ca8..86672db5 100644 +index 59a432ee..d6d22fc0 100644 --- a/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_groupowner_cron_allow/rule.yml +++ b/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_groupowner_cron_allow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle15 title: 'Verify Group Who Owns /etc/cron.allow file' diff --git a/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_owner_cron_allow/rule.yml b/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_owner_cron_allow/rule.yml -index 56afe264..90251231 100644 +index f68f9293..c86deea0 100644 --- a/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_owner_cron_allow/rule.yml +++ b/linux_os/guide/services/cron_and_at/restrict_at_cron_users/file_owner_cron_allow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle15 title: 'Verify User Who Owns /etc/cron.allow file' diff --git a/linux_os/guide/services/cron_and_at/service_atd_disabled/rule.yml b/linux_os/guide/services/cron_and_at/service_atd_disabled/rule.yml -index b1d800fe..e5afc5ac 100644 +index f710f01e..2a19ca89 100644 --- a/linux_os/guide/services/cron_and_at/service_atd_disabled/rule.yml +++ b/linux_os/guide/services/cron_and_at/service_atd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable At Service (atd)' diff --git a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml -index 37b6f9a7..21e6aa92 100644 +index 96998c18..05f33306 100644 --- a/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml +++ b/linux_os/guide/services/cron_and_at/service_crond_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable cron Service' diff --git a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_configure_logging/rule.yml b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_configure_logging/rule.yml -index a4b21993..454e8335 100644 +index 6baf9026..81a9ad03 100644 --- a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_configure_logging/rule.yml +++ b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_configure_logging/rule.yml @@ -1,6 +1,6 @@ @@ -7187,7 +704,7 @@ index a4b21993..454e8335 100644 title: 'Configure Logging' diff --git a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_bootp/rule.yml b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_bootp/rule.yml -index 60d78d25..e440c66d 100644 +index 1d825698..8c28acb9 100644 --- a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_bootp/rule.yml +++ b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_bootp/rule.yml @@ -1,6 +1,6 @@ @@ -7199,7 +716,7 @@ index 60d78d25..e440c66d 100644 title: 'Deny BOOTP Queries' diff --git a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_decline/rule.yml b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_decline/rule.yml -index ff1bb2ab..ae9809c7 100644 +index 4b0fa9a5..f50fe476 100644 --- a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_decline/rule.yml +++ b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_deny_decline/rule.yml @@ -1,6 +1,6 @@ @@ -7211,7 +728,7 @@ index ff1bb2ab..ae9809c7 100644 title: 'Deny Decline Messages' diff --git a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_disable_ddns/rule.yml b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_disable_ddns/rule.yml -index 5bdfc859..51f19a17 100644 +index e9cdf799..71db5eef 100644 --- a/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_disable_ddns/rule.yml +++ b/linux_os/guide/services/dhcp/dhcp_server_configuration/dhcp_server_disable_ddns/rule.yml @@ -1,6 +1,6 @@ @@ -7223,7 +740,7 @@ index 5bdfc859..51f19a17 100644 title: 'Do Not Use Dynamic DNS' diff --git a/linux_os/guide/services/dhcp/disabling_dhcp_client/sysconfig_networking_bootproto_ifcfg/rule.yml b/linux_os/guide/services/dhcp/disabling_dhcp_client/sysconfig_networking_bootproto_ifcfg/rule.yml -index 64fea96b..47089e6e 100644 +index 6c9c0b02..bda84dff 100644 --- a/linux_os/guide/services/dhcp/disabling_dhcp_client/sysconfig_networking_bootproto_ifcfg/rule.yml +++ b/linux_os/guide/services/dhcp/disabling_dhcp_client/sysconfig_networking_bootproto_ifcfg/rule.yml @@ -1,6 +1,6 @@ @@ -7235,55 +752,77 @@ index 64fea96b..47089e6e 100644 title: 'Disable DHCP Client in ifcfg' diff --git a/linux_os/guide/services/dhcp/disabling_dhcp_server/package_dhcp_removed/rule.yml b/linux_os/guide/services/dhcp/disabling_dhcp_server/package_dhcp_removed/rule.yml -index 42273fd5..649e02ef 100644 +index d66078ac..8ced3d6f 100644 --- a/linux_os/guide/services/dhcp/disabling_dhcp_server/package_dhcp_removed/rule.yml +++ b/linux_os/guide/services/dhcp/disabling_dhcp_server/package_dhcp_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Uninstall DHCP Server Package' diff --git a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml -index 007dc178..68563051 100644 +index 79a554aa..e0f3407a 100644 --- a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml +++ b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable DHCP Service' +diff --git a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_disabled.pass.sh b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_disabled.pass.sh +index 106fa973..8b336374 100644 +--- a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_disabled.pass.sh ++++ b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_disabled.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # packages = dhcp-server + + systemctl stop dhcpd +diff --git a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_enabled.fail.sh b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_enabled.fail.sh +index 83a1887e..6e803cf5 100644 +--- a/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_enabled.fail.sh ++++ b/linux_os/guide/services/dhcp/disabling_dhcp_server/service_dhcpd_disabled/tests/rhel8_enabled.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # packages = dhcp-server + + # Simple configuration for dhcp so we can start the service diff --git a/linux_os/guide/services/dns/disabling_dns_server/package_bind_removed/rule.yml b/linux_os/guide/services/dns/disabling_dns_server/package_bind_removed/rule.yml -index 48a25265..89f8ef7d 100644 +index 0c0afbed..68e94178 100644 --- a/linux_os/guide/services/dns/disabling_dns_server/package_bind_removed/rule.yml +++ b/linux_os/guide/services/dns/disabling_dns_server/package_bind_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004 title: 'Uninstall bind Package' diff --git a/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml b/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml -index d371769b..99ebf7ac 100644 +index ad48971c..55a47e6c 100644 --- a/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml +++ b/linux_os/guide/services/dns/disabling_dns_server/service_named_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable named Service' diff --git a/linux_os/guide/services/dns/dns_server_protection/dns_server_authenticate_zone_transfers/rule.yml b/linux_os/guide/services/dns/dns_server_protection/dns_server_authenticate_zone_transfers/rule.yml -index b87046b2..8c06bcf5 100644 +index f8220f53..239b7f2e 100644 --- a/linux_os/guide/services/dns/dns_server_protection/dns_server_authenticate_zone_transfers/rule.yml +++ b/linux_os/guide/services/dns/dns_server_protection/dns_server_authenticate_zone_transfers/rule.yml @@ -1,6 +1,6 @@ @@ -7318,81 +857,78 @@ index 05aa2344..8c441644 100644 title: 'Disable Zone Transfers from the Nameserver' -diff --git a/linux_os/guide/services/docker/docker_selinux_enabled/rule.yml b/linux_os/guide/services/docker/docker_selinux_enabled/rule.yml -index 443372d6..dcfc3fbc 100644 ---- a/linux_os/guide/services/docker/docker_selinux_enabled/rule.yml -+++ b/linux_os/guide/services/docker/docker_selinux_enabled/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 - - title: 'Ensure SELinux support is enabled in Docker' - diff --git a/linux_os/guide/services/fapolicyd/package_fapolicyd_installed/rule.yml b/linux_os/guide/services/fapolicyd/package_fapolicyd_installed/rule.yml -index 5869cac7..9c73f25a 100644 +index 1c526f6b..05d61a7b 100644 --- a/linux_os/guide/services/fapolicyd/package_fapolicyd_installed/rule.yml +++ b/linux_os/guide/services/fapolicyd/package_fapolicyd_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Install fapolicyd Package' +@@ -22,7 +22,7 @@ references: + disa: CCI-001764 + nist: CM-6(a),SI-4(22) + srg: SRG-OS-000370-GPOS-00155,SRG-OS-000368-GPOS-00154 +- stigid@rhel8: RHEL-08-040135 ++ stigid@almalinux8: RHEL-08-040135 + + ocil_clause: 'the package is not installed' + diff --git a/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml b/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml -index 44b97a8d..747727f7 100644 +index 4a1cd166..2f00a8c2 100644 --- a/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml +++ b/linux_os/guide/services/fapolicyd/service_fapolicyd_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol8,rhel8 -+prodtype: rhcos4,ol8,rhel8,almalinux8 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Enable the File Access Policy Service' -@@ -22,7 +22,7 @@ references: +@@ -24,7 +24,7 @@ references: nist: CM-6(a),SI-4(22) ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000370-GPOS-00155 -- stigid@rhel8: RHEL-08-040135 -+ stigid@almalinux8: RHEL-08-040135 + srg: SRG-OS-000370-GPOS-00155,SRG-OS-000368-GPOS-00154 +- stigid@rhel8: RHEL-08-040136 ++ stigid@almalinux8: RHEL-08-040136 ocil_clause: 'the service is not enabled' diff --git a/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/rule.yml b/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/rule.yml -index dc7d79af..03371112 100644 +index 4602d5c7..2805c73a 100644 --- a/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/rule.yml +++ b/linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Uninstall vsftpd Package' -@@ -28,7 +28,7 @@ references: - cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS05.02,DSS05.05,DSS06.06 - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.9.1.2 - cis-csc: 11,14,3,9 +@@ -33,7 +33,7 @@ references: + srg: SRG-OS-000074-GPOS-00042,SRG-OS-000095-GPOS-00049,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040690 + stigid@rhel7: RHEL-07-040690 - stigid@rhel8: RHEL-08-040360 + stigid@almalinux8: RHEL-08-040360 - - {{{ complete_ocil_entry_package(package="vsftpd") }}} - + stigid@sle12: SLES-12-030011 + stigid@sle15: SLES-15-010030 + diff --git a/linux_os/guide/services/ftp/disabling_vsftpd/service_vsftpd_disabled/rule.yml b/linux_os/guide/services/ftp/disabling_vsftpd/service_vsftpd_disabled/rule.yml -index 170f7c10..f5f7a79b 100644 +index bdd7f045..d613b728 100644 --- a/linux_os/guide/services/ftp/disabling_vsftpd/service_vsftpd_disabled/rule.yml +++ b/linux_os/guide/services/ftp/disabling_vsftpd/service_vsftpd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable vsftpd Service' @@ -7433,7 +969,7 @@ index 3f9a0e0d..04625628 100644 title: 'Enable Logging of All FTP Transactions' diff --git a/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml b/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml -index 3590a085..adce7751 100644 +index 3cacb857..0ce945f0 100644 --- a/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml +++ b/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_present_banner/rule.yml @@ -1,6 +1,6 @@ @@ -7445,7 +981,7 @@ index 3590a085..adce7751 100644 title: 'Create Warning Banners for All FTP Users' diff --git a/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_restrict_users/ftp_restrict_to_anon/rule.yml b/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_restrict_users/ftp_restrict_to_anon/rule.yml -index 855536ac..5b586fc7 100644 +index 2782961b..e74183f3 100644 --- a/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_restrict_users/ftp_restrict_to_anon/rule.yml +++ b/linux_os/guide/services/ftp/ftp_configure_vsftpd/ftp_restrict_users/ftp_restrict_to_anon/rule.yml @@ -1,6 +1,6 @@ @@ -7457,7 +993,7 @@ index 855536ac..5b586fc7 100644 title: 'Restrict Access to Anonymous Users if Possible' diff --git a/linux_os/guide/services/ftp/ftp_use_vsftpd/package_vsftpd_installed/rule.yml b/linux_os/guide/services/ftp/ftp_use_vsftpd/package_vsftpd_installed/rule.yml -index 7dd28336..b8c71814 100644 +index 6aa51e73..289415f1 100644 --- a/linux_os/guide/services/ftp/ftp_use_vsftpd/package_vsftpd_installed/rule.yml +++ b/linux_os/guide/services/ftp/ftp_use_vsftpd/package_vsftpd_installed/rule.yml @@ -1,6 +1,6 @@ @@ -7469,26 +1005,26 @@ index 7dd28336..b8c71814 100644 title: 'Install vsftpd Package' diff --git a/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml b/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml -index d04d858c..727442b6 100644 +index 0f543c9b..1e2a4465 100644 --- a/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml +++ b/linux_os/guide/services/http/disabling_httpd/package_httpd_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Uninstall httpd Package' diff --git a/linux_os/guide/services/http/disabling_httpd/service_httpd_disabled/rule.yml b/linux_os/guide/services/http/disabling_httpd/service_httpd_disabled/rule.yml -index a9324493..63bc0445 100644 +index cdc6ba69..6f6b1f12 100644 --- a/linux_os/guide/services/http/disabling_httpd/service_httpd_disabled/rule.yml +++ b/linux_os/guide/services/http/disabling_httpd/service_httpd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable httpd Service' @@ -7541,7 +1077,7 @@ index 2d0a5c51..8de48bb4 100644 title: 'Configure firewall to Allow Access to the Web Server' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_configure_remote_session_encryption/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_configure_remote_session_encryption/rule.yml -index 1d308d43..24bb3080 100644 +index afc9519f..09dc97cb 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_configure_remote_session_encryption/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_configure_remote_session_encryption/rule.yml @@ -1,6 +1,6 @@ @@ -7553,7 +1089,7 @@ index 1d308d43..24bb3080 100644 title: 'Ensure Remote Administrative Access Is Encrypted' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_etc_httpd_conf/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_etc_httpd_conf/rule.yml -index 2cbde0fa..6f41e4cc 100644 +index 91174c07..50ceb9d0 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_etc_httpd_conf/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_etc_httpd_conf/rule.yml @@ -1,6 +1,6 @@ @@ -7565,7 +1101,7 @@ index 2cbde0fa..6f41e4cc 100644 title: 'Set Permissions on the /etc/httpd/conf/ Directory' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_var_log_httpd/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_var_log_httpd/rule.yml -index 37e42437..9ab06079 100644 +index dedc508f..5f0e74c8 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_var_log_httpd/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/dir_perms_var_log_httpd/rule.yml @@ -1,6 +1,6 @@ @@ -7577,38 +1113,38 @@ index 37e42437..9ab06079 100644 title: 'Set Permissions on the /var/log/httpd/ Directory' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_d_files/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_d_files/rule.yml -index 45af243c..076664c6 100644 +index d8631eb9..1fc8f7b4 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_d_files/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_d_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Set Permissions on All Configuration Files Inside /etc/httpd/conf.d/' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_files/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_files/rule.yml -index 4af25998..19470cb2 100644 +index 5227203b..e31765b0 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_files/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_conf_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Set Permissions on All Configuration Files Inside /etc/httpd/conf/' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_modules_files/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_modules_files/rule.yml -index 26651d59..0b88b0f5 100644 +index 1af8689b..a0623cc7 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_modules_files/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_configure_os_protect_web_server/httpd_restrict_file_dir_access/file_permissions_httpd_server_modules_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Set Permissions on All Configuration Files Inside /etc/httpd/conf.modules.d/' @@ -8069,7 +1605,7 @@ index c26a075a..79294345 100644 title: 'Backup interactive scripts on the production web server are prohibited' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_serversignature_off/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_serversignature_off/rule.yml -index 4719ef73..1831de59 100644 +index 433ce96d..56729d6b 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_serversignature_off/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_serversignature_off/rule.yml @@ -1,6 +1,6 @@ @@ -8081,7 +1617,7 @@ index 4719ef73..1831de59 100644 title: 'Set httpd ServerSignature Directive to Off' diff --git a/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_servertokens_prod/rule.yml b/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_servertokens_prod/rule.yml -index 2b03cd50..8e06307b 100644 +index af49aaeb..9aa5d9a2 100644 --- a/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_servertokens_prod/rule.yml +++ b/linux_os/guide/services/http/securing_httpd/httpd_restrict_info_leakage/httpd_servertokens_prod/rule.yml @@ -1,6 +1,6 @@ @@ -8225,65 +1761,56 @@ index d88e1120..5744fe45 100644 title: 'Enable the SSL flag in /etc/dovecot.conf' diff --git a/linux_os/guide/services/imap/disabling_dovecot/package_dovecot_removed/rule.yml b/linux_os/guide/services/imap/disabling_dovecot/package_dovecot_removed/rule.yml -index 597cb2cd..9ec62022 100644 +index 8b31a76b..30c73587 100644 --- a/linux_os/guide/services/imap/disabling_dovecot/package_dovecot_removed/rule.yml +++ b/linux_os/guide/services/imap/disabling_dovecot/package_dovecot_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Uninstall dovecot Package' diff --git a/linux_os/guide/services/imap/disabling_dovecot/service_dovecot_disabled/rule.yml b/linux_os/guide/services/imap/disabling_dovecot/service_dovecot_disabled/rule.yml -index d4436fe0..35c07c01 100644 +index d460c186..46ebf86a 100644 --- a/linux_os/guide/services/imap/disabling_dovecot/service_dovecot_disabled/rule.yml +++ b/linux_os/guide/services/imap/disabling_dovecot/service_dovecot_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable Dovecot Service' -diff --git a/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/bash/shared.sh b/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/bash/shared.sh -index b411f4fb..c66adbcb 100644 ---- a/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/bash/shared.sh -+++ b/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/bash/shared.sh -@@ -1,3 +1,3 @@ --# platform = Oracle Linux 8,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora -+# platform = Oracle Linux 8,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora - - rm -f /etc/*.keytab diff --git a/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/rule.yml b/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/rule.yml -index d29370c9..44de2d7e 100644 +index d6bf12ad..892bd7bd 100644 --- a/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/rule.yml +++ b/linux_os/guide/services/kerberos/kerberos_disable_no_keytab/rule.yml -@@ -20,7 +20,7 @@ references: +@@ -22,7 +22,7 @@ references: + ism: 0418,1055,1402 ospp: FTP_ITC_EXT.1 srg: SRG-OS-000120-GPOS-00061 - ism: 0418,1055,1402 - stigid@rhel8: RHEL-08-010161 + stigid@almalinux8: RHEL-08-010161 ocil_clause: 'it is present on the system' diff --git a/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml b/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml -index 30a9fca8..ad755e59 100644 +index 52efaf10..b6a8f0fb 100644 --- a/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml +++ b/linux_os/guide/services/kerberos/package_krb5-server_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Remove the Kerberos Server Package' diff --git a/linux_os/guide/services/ldap/389_ds/package_389-ds-base_removed/rule.yml b/linux_os/guide/services/ldap/389_ds/package_389-ds-base_removed/rule.yml -index 4aedda80..9a35ccb3 100644 +index a85ce9dd..c8551652 100644 --- a/linux_os/guide/services/ldap/389_ds/package_389-ds-base_removed/rule.yml +++ b/linux_os/guide/services/ldap/389_ds/package_389-ds-base_removed/rule.yml @@ -1,6 +1,6 @@ @@ -8295,7 +1822,7 @@ index 4aedda80..9a35ccb3 100644 title: 'Uninstall 389-ds-base Package' diff --git a/linux_os/guide/services/ldap/openldap_client/enable_ldap_client/rule.yml b/linux_os/guide/services/ldap/openldap_client/enable_ldap_client/rule.yml -index 75d7b2a6..0d3ba74f 100644 +index 9a86c7ab..5a8e1fda 100644 --- a/linux_os/guide/services/ldap/openldap_client/enable_ldap_client/rule.yml +++ b/linux_os/guide/services/ldap/openldap_client/enable_ldap_client/rule.yml @@ -1,6 +1,6 @@ @@ -8306,23 +1833,6 @@ index 75d7b2a6..0d3ba74f 100644 title: 'Enable the LDAP Client For Use in Authconfig' -diff --git a/linux_os/guide/services/ldap/openldap_client/group.yml b/linux_os/guide/services/ldap/openldap_client/group.yml -index 77a121dd..b6e59025 100644 ---- a/linux_os/guide/services/ldap/openldap_client/group.yml -+++ b/linux_os/guide/services/ldap/openldap_client/group.yml -@@ -11,12 +11,6 @@ description: |- - much control over configuration as manual editing of configuration files. The - authconfig tools do not allow you to specify locations of SSL certificate - files, which is useful when trying to use SSL cleanly across several protocols. -- Installation and configuration of OpenLDAP on {{{ full_name }}} is available at -- {{% if product == "rhel7" %}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/openldap.html") }}}. -- {{% elif product == "ol7" %}} -- {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-s9-auth.html") }}}. -- {{% endif %}} - - warnings: - - general: |- diff --git a/linux_os/guide/services/ldap/openldap_client/ldap_client_start_tls/bash/shared.sh b/linux_os/guide/services/ldap/openldap_client/ldap_client_start_tls/bash/shared.sh index fbaef339..0e7f24c3 100644 --- a/linux_os/guide/services/ldap/openldap_client/ldap_client_start_tls/bash/shared.sh @@ -8334,7 +1844,7 @@ index fbaef339..0e7f24c3 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/ldap/openldap_client/ldap_client_start_tls/rule.yml b/linux_os/guide/services/ldap/openldap_client/ldap_client_start_tls/rule.yml -index 1060d079..9037f742 100644 +index 4f64afff..348ddaa5 100644 --- a/linux_os/guide/services/ldap/openldap_client/ldap_client_start_tls/rule.yml +++ b/linux_os/guide/services/ldap/openldap_client/ldap_client_start_tls/rule.yml @@ -1,6 +1,6 @@ @@ -8346,7 +1856,7 @@ index 1060d079..9037f742 100644 title: 'Configure LDAP Client to Use TLS For All Transactions' diff --git a/linux_os/guide/services/ldap/openldap_client/ldap_client_tls_cacertpath/rule.yml b/linux_os/guide/services/ldap/openldap_client/ldap_client_tls_cacertpath/rule.yml -index 52da6cca..1c513b06 100644 +index e05e43a9..9ea470b8 100644 --- a/linux_os/guide/services/ldap/openldap_client/ldap_client_tls_cacertpath/rule.yml +++ b/linux_os/guide/services/ldap/openldap_client/ldap_client_tls_cacertpath/rule.yml @@ -1,6 +1,6 @@ @@ -8358,75 +1868,63 @@ index 52da6cca..1c513b06 100644 title: 'Configure Certificate Directives for LDAP Use of TLS' diff --git a/linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml b/linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml -index eb975656..625cbed6 100644 +index e5f56cb0..f368cc2b 100644 --- a/linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml +++ b/linux_os/guide/services/ldap/openldap_client/package_openldap-clients_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Ensure LDAP client is not installed' -diff --git a/linux_os/guide/services/ldap/openldap_server/group.yml b/linux_os/guide/services/ldap/openldap_server/group.yml -index c180820e..510d5c6e 100644 ---- a/linux_os/guide/services/ldap/openldap_server/group.yml -+++ b/linux_os/guide/services/ldap/openldap_server/group.yml -@@ -5,7 +5,3 @@ title: 'Configure OpenLDAP Server' - description: |- - This section details some security-relevant settings - for an OpenLDAP server. -- {{% if product == "rhel7" %}} -- Installation and configuration of OpenLDAP on Red Hat Enterprise Linux 7 is available at: -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/openldap.html") }}}. -- {{% endif %}} diff --git a/linux_os/guide/services/ldap/openldap_server/package_openldap-servers_removed/rule.yml b/linux_os/guide/services/ldap/openldap_server/package_openldap-servers_removed/rule.yml -index ce08c70d..e39d33a9 100644 +index c39d7eaa..44f46747 100644 --- a/linux_os/guide/services/ldap/openldap_server/package_openldap-servers_removed/rule.yml +++ b/linux_os/guide/services/ldap/openldap_server/package_openldap-servers_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Uninstall openldap-servers Package' diff --git a/linux_os/guide/services/mail/package_sendmail_removed/rule.yml b/linux_os/guide/services/mail/package_sendmail_removed/rule.yml -index ed29daa2..c9e90666 100644 +index e423e23e..5f1be867 100644 --- a/linux_os/guide/services/mail/package_sendmail_removed/rule.yml +++ b/linux_os/guide/services/mail/package_sendmail_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall Sendmail Package' -@@ -30,7 +30,7 @@ references: - cis-csc: 11,14,3,9 - anssi: BP28(R1) - srg: SRG-OS-000480-GPOS-00227 +@@ -32,7 +32,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a) + nist-csf: PR.IP-1,PR.PT-3 + srg: SRG-OS-000480-GPOS-00227,SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040002 + stigid@almalinux8: RHEL-08-040002 {{{ complete_ocil_entry_package(package="sendmail") }}} diff --git a/linux_os/guide/services/mail/postfix_client/postfix_client_configure_mail_alias/rule.yml b/linux_os/guide/services/mail/postfix_client/postfix_client_configure_mail_alias/rule.yml -index ea30438a..2d4412cb 100644 +index f36e8751..192706bc 100644 --- a/linux_os/guide/services/mail/postfix_client/postfix_client_configure_mail_alias/rule.yml +++ b/linux_os/guide/services/mail/postfix_client/postfix_client_configure_mail_alias/rule.yml @@ -31,7 +31,7 @@ references: - disa@sle12: CCI-000139 + nist: CM-6(a) nist@sle12: AU-5(a),AU-5.1(ii) - anssi: BP28(R49) + srg: SRG-OS-000046-GPOS-00022 - stigid@rhel8: RHEL-08-030030 + stigid@almalinux8: RHEL-08-030030 - srg: SRG-OS-000046-GPOS-00022 + stigid@sle12: SLES-12-020050 + stigid@sle15: SLES-15-030580 - ocil_clause: 'it is not' diff --git a/linux_os/guide/services/mail/postfix_client/postfix_network_listening_disabled/ansible/shared.yml b/linux_os/guide/services/mail/postfix_client/postfix_network_listening_disabled/ansible/shared.yml index e1c9d00d..df00159e 100644 --- a/linux_os/guide/services/mail/postfix_client/postfix_network_listening_disabled/ansible/shared.yml @@ -8448,19 +1946,19 @@ index 2ef07dd1..13153d5d 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/mail/postfix_client/postfix_network_listening_disabled/rule.yml b/linux_os/guide/services/mail/postfix_client/postfix_network_listening_disabled/rule.yml -index b3a9ce8f..94edaf3b 100644 +index 096020ef..9c4f38a6 100644 --- a/linux_os/guide/services/mail/postfix_client/postfix_network_listening_disabled/rule.yml +++ b/linux_os/guide/services/mail/postfix_client/postfix_network_listening_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable Postfix Network Listening' diff --git a/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_banner/rule.yml b/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_banner/rule.yml -index 3b75cba8..d379051f 100644 +index e169429a..d9f0688b 100644 --- a/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_banner/rule.yml +++ b/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_banner/rule.yml @@ -1,6 +1,6 @@ @@ -8482,7 +1980,7 @@ index 20230621..be441dc9 100644 if ! grep -q ^smtpd_client_restrictions /etc/postfix/main.cf; then echo "smtpd_client_restrictions = permit_mynetworks,reject" >> /etc/postfix/main.cf diff --git a/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/rule.yml b/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/rule.yml -index 0a3d8188..9bff47f1 100644 +index 9b4c7656..fbb2dd34 100644 --- a/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/rule.yml +++ b/linux_os/guide/services/mail/postfix_harden_os/postfix_server_cfg/postfix_server_relay/postfix_prevent_unrestricted_relay/rule.yml @@ -1,6 +1,6 @@ @@ -8494,8 +1992,8 @@ index 0a3d8188..9bff47f1 100644 title: 'Prevent Unrestricted Mail Relaying' @@ -25,7 +25,7 @@ references: - disa: CCI-000366 srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040680 stigid@rhel7: RHEL-07-040680 - stigid@rhel8: RHEL-08-040290 + stigid@almalinux8: RHEL-08-040290 @@ -8503,14 +2001,14 @@ index 0a3d8188..9bff47f1 100644 ocil_clause: 'it is not' diff --git a/linux_os/guide/services/mail/service_postfix_enabled/rule.yml b/linux_os/guide/services/mail/service_postfix_enabled/rule.yml -index 6f47a9c2..896bfd3b 100644 +index 0906d520..b2edb453 100644 --- a/linux_os/guide/services/mail/service_postfix_enabled/rule.yml +++ b/linux_os/guide/services/mail/service_postfix_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Enable Postfix Service' @@ -8527,14 +2025,14 @@ index 2524bf79..e398c312 100644 title: 'Disable Network File System Lock Service (nfslock)' diff --git a/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml b/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml -index 841bcaa4..a9f5076c 100644 +index a44f0c1c..b0ed3ec0 100644 --- a/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/disabling_nfs/disabling_nfs_services/service_rpcbind_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable rpcbind Service' @@ -8623,19 +2121,41 @@ index 73a0d70b..36a53e46 100644 title: 'Specify UID and GID for Anonymous NFS Connections' diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/rule.yml -index aafb650d..7810022b 100644 +index f99879c8..6224464d 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,sle15 -+prodtype: fedora,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Network File System (nfs)' +diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/disabled.pass.sh b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/disabled.pass.sh +index 30af5520..722a8f2e 100644 +--- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/disabled.pass.sh ++++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/disabled.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora + # packages = nfs-utils + + systemctl stop nfs-server +diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/enabled.fail.sh b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/enabled.fail.sh +index 8e4eee8b..db823921 100644 +--- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/enabled.fail.sh ++++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_nfs_disabled/tests/enabled.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora + # packages = nfs-utils + + systemctl start nfs-server diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_rpcsvcgssd_disabled/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_rpcsvcgssd_disabled/rule.yml -index 8699bc19..cd58d4ca 100644 +index bb5788e3..3703a84c 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_rpcsvcgssd_disabled/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/disabling_nfsd/service_rpcsvcgssd_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -8647,79 +2167,79 @@ index 8699bc19..cd58d4ca 100644 title: 'Disable Secure RPC Server Service (rpcsvcgssd)' diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/rule.yml -index c8d08650..f43e094c 100644 +index 65bcba60..97f66925 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_krb_sec_remote_filesystems/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,wrlinux1019 title: 'Mount Remote Filesystems with Kerberos Security' diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nodev_remote_filesystems/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nodev_remote_filesystems/rule.yml -index 66f45589..30038812 100644 +index d63203f4..c7e60f8c 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nodev_remote_filesystems/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nodev_remote_filesystems/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Mount Remote Filesystems with nodev' -@@ -24,7 +24,7 @@ references: - cobit5: APO13.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS05.02,DSS05.05,DSS05.06,DSS06.06 - iso27001-2013: A.11.2.9,A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.8.2.1,A.8.2.2,A.8.2.3,A.8.3.1,A.8.3.3,A.9.1.2 - cis-csc: 11,13,14,3,8,9 +@@ -27,7 +27,7 @@ references: + nist: CM-6(a),MP-2 + nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 + srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010640 + stigid@almalinux8: RHEL-08-010640 - srg: SRG-OS-000480-GPOS-00227 ocil_clause: 'the setting does not show' + diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_noexec_remote_filesystems/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_noexec_remote_filesystems/rule.yml -index 4a50d796..5ac95123 100644 +index 1cf30f82..03862b9c 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_noexec_remote_filesystems/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_noexec_remote_filesystems/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Mount Remote Filesystems with noexec' -@@ -32,7 +32,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 - stigid@sle12: SLES-12-010820 +@@ -33,7 +33,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021021 + stigid@rhel7: RHEL-07-021021 - stigid@rhel8: RHEL-08-010630 + stigid@almalinux8: RHEL-08-010630 - - ocil_clause: 'the setting does not show' + stigid@sle12: SLES-12-010820 + stigid@sle15: SLES-15-040170 diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nosuid_remote_filesystems/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nosuid_remote_filesystems/rule.yml -index 695e1a1e..0d34b434 100644 +index e49d8c01..f8b49e72 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nosuid_remote_filesystems/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_clients/mounting_remote_filesystems/mount_option_nosuid_remote_filesystems/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Mount Remote Filesystems with nosuid' -@@ -30,7 +30,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 - stigid@sle12: SLES-12-010810 +@@ -31,7 +31,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021020 + stigid@rhel7: RHEL-07-021020 - stigid@rhel8: RHEL-08-010650 + stigid@almalinux8: RHEL-08-010650 - - ocil_clause: 'the setting does not show' + stigid@sle12: SLES-12-010810 + stigid@sle15: SLES-15-040160 diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/no_insecure_locks_exports/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/no_insecure_locks_exports/rule.yml index daaf44ae..548c4d83 100644 @@ -8734,7 +2254,7 @@ index daaf44ae..548c4d83 100644 title: 'Ensure Insecure File Locking is Not Allowed' diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/restrict_nfs_clients_to_privileged_ports/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/restrict_nfs_clients_to_privileged_ports/rule.yml -index 232bf40a..00636b06 100644 +index 0978d54c..00145705 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/restrict_nfs_clients_to_privileged_ports/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/restrict_nfs_clients_to_privileged_ports/rule.yml @@ -1,6 +1,6 @@ @@ -8746,14 +2266,14 @@ index 232bf40a..00636b06 100644 title: 'Restrict NFS Clients to Privileged Ports' diff --git a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/use_kerberos_security_all_exports/rule.yml b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/use_kerberos_security_all_exports/rule.yml -index 7b70a652..61f6473a 100644 +index 2bffffda..912a4d99 100644 --- a/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/use_kerberos_security_all_exports/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/nfs_configuring_servers/use_kerberos_security_all_exports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Use Kerberos Security on All Exports' @@ -8770,14 +2290,14 @@ index c5983cbe..0f39d0ff 100644 title: 'Use Root-Squashing on All Exports' diff --git a/linux_os/guide/services/nfs_and_rpc/package_nfs-utils_removed/rule.yml b/linux_os/guide/services/nfs_and_rpc/package_nfs-utils_removed/rule.yml -index ed7373a2..8b632f90 100644 +index 887320e1..3e194ea1 100644 --- a/linux_os/guide/services/nfs_and_rpc/package_nfs-utils_removed/rule.yml +++ b/linux_os/guide/services/nfs_and_rpc/package_nfs-utils_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall nfs-utils Package' @@ -8792,31 +2312,32 @@ index f6c14e4f..c2a7dfc4 100644 # Include source function library . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/ntp/chronyd_client_only/kubernetes/shared.yml b/linux_os/guide/services/ntp/chronyd_client_only/kubernetes/shared.yml -index bf524043..c6bf40d3 100644 +index a97cf1a9..f285ebb4 100644 --- a/linux_os/guide/services/ntp/chronyd_client_only/kubernetes/shared.yml +++ b/linux_os/guide/services/ntp/chronyd_client_only/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/services/ntp/chronyd_client_only/rule.yml b/linux_os/guide/services/ntp/chronyd_client_only/rule.yml -index 83d1ba0d..e28d3546 100644 +index 630d8fdc..c649ceb9 100644 --- a/linux_os/guide/services/ntp/chronyd_client_only/rule.yml +++ b/linux_os/guide/services/ntp/chronyd_client_only/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Disable chrony daemon from acting as server' -@@ -24,7 +24,7 @@ identifiers: - references: +@@ -26,7 +26,7 @@ references: + disa: CCI-000381 ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000096-GPOS-00050 + srg: SRG-OS-000096-GPOS-00050,SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-030741 + stigid@almalinux8: RHEL-08-030741 @@ -8833,31 +2354,32 @@ index 13f20d64..97cfbaae 100644 # Include source function library . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/ntp/chronyd_no_chronyc_network/kubernetes/shared.yml b/linux_os/guide/services/ntp/chronyd_no_chronyc_network/kubernetes/shared.yml -index 6bb5e59b..f53e242d 100644 +index a97cf1a9..f285ebb4 100644 --- a/linux_os/guide/services/ntp/chronyd_no_chronyc_network/kubernetes/shared.yml +++ b/linux_os/guide/services/ntp/chronyd_no_chronyc_network/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/services/ntp/chronyd_no_chronyc_network/rule.yml b/linux_os/guide/services/ntp/chronyd_no_chronyc_network/rule.yml -index d6d776a9..46bf3412 100644 +index 6b834911..96d5c240 100644 --- a/linux_os/guide/services/ntp/chronyd_no_chronyc_network/rule.yml +++ b/linux_os/guide/services/ntp/chronyd_no_chronyc_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Disable network management of chrony daemon' -@@ -24,7 +24,7 @@ identifiers: - references: +@@ -26,7 +26,7 @@ references: + disa: CCI-000381 ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000096-GPOS-00050 + srg: SRG-OS-000096-GPOS-00050,SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-030742 + stigid@almalinux8: RHEL-08-030742 @@ -8873,27 +2395,38 @@ index b23deffb..a9e4d9ba 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_time_service_set_maxpoll") }}} +diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/kubernetes/shared.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/kubernetes/shared.yml +index a97cf1a9..f285ebb4 100644 +--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/kubernetes/shared.yml ++++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml -index 8d12b741..38e88460 100644 +index 854e8e80..24d067d6 100644 --- a/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml +++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_set_maxpoll/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Configure Time Service Maxpoll Interval' -@@ -43,7 +43,7 @@ references: - cis-csc: 1,14,15,16,3,5,6 - stigid@sle12: SLES-12-030300 - nist@sle12: AU-8(1)(a),AU-8(1)(b) +@@ -93,7 +93,7 @@ references: + srg: SRG-OS-000355-GPOS-00143,SRG-OS-000356-GPOS-00144,SRG-OS-000359-GPOS-00146 + stigid@ol7: OL07-00-040500 + stigid@rhel7: RHEL-07-040500 - stigid@rhel8: RHEL-08-030740 + stigid@almalinux8: RHEL-08-030740 - - ocil_clause: 'it does not exist or maxpoll has not been set to the expected value' - + stigid@sle12: SLES-12-030300 + stigid@sle15: SLES-15-010400 + stigid@ubuntu2004: UBTU-20-010435 diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/bash/shared.sh b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/bash/shared.sh index 9add69d3..944e1865 100644 --- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/bash/shared.sh @@ -8904,8 +2437,19 @@ index 9add69d3..944e1865 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_multiple_time_servers") }}} +diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/kubernetes/shared.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/kubernetes/shared.yml +index a97cf1a9..f285ebb4 100644 +--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/kubernetes/shared.yml ++++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml -index d64f0308..5199d1b5 100644 +index 7dc18858..7a2de3bf 100644 --- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml +++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_multiple_servers/rule.yml @@ -1,6 +1,6 @@ @@ -8916,22 +2460,6 @@ index d64f0308..5199d1b5 100644 title: 'Specify Additional Remote NTP Servers' -@@ -8,14 +8,7 @@ description: |- - Depending on specific functional requirements of a concrete - production environment, the {{{ full_name }}} system can be - configured to utilize the services of the <tt>chronyd</tt> NTP daemon (the -- default), or services of the <tt>ntpd</tt> NTP daemon. Refer to -- {{% if product in ["ol7", "ol8"] %}} -- {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-nettime.html") }}} -- {{% else %}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}} -- {{% endif %}} -- for more detailed comparison of the features of both of the choices, and for -- further guidance how to choose between the two NTP daemons. -+ default), or services of the <tt>ntpd</tt> NTP daemon. - <br /> - Additional NTP servers can be specified for time synchronization. To do so, - perform the following: diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/bash/shared.sh b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/bash/shared.sh index 0a3f6364..d0e0610b 100644 --- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/bash/shared.sh @@ -8942,8 +2470,19 @@ index 0a3f6364..d0e0610b 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_multiple_time_servers") }}} +diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/kubernetes/shared.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/kubernetes/shared.yml +index a97cf1a9..f285ebb4 100644 +--- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/kubernetes/shared.yml ++++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml -index ff485aeb..4a99e4b8 100644 +index 27df8595..dd740663 100644 --- a/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml +++ b/linux_os/guide/services/ntp/chronyd_or_ntpd_specify_remote_server/rule.yml @@ -1,6 +1,6 @@ @@ -8954,22 +2493,6 @@ index ff485aeb..4a99e4b8 100644 title: 'Specify a Remote NTP Server' -@@ -8,14 +8,7 @@ description: |- - Depending on specific functional requirements of a concrete - production environment, the {{{ full_name }}} system can be - configured to utilize the services of the <tt>chronyd</tt> NTP daemon (the -- default), or services of the <tt>ntpd</tt> NTP daemon. Refer to -- {{% if product in ["ol7", "ol8"] %}} -- {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-nettime.html") }}} -- {{% else %}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}} -- {{% endif %}} -- for more detailed comparison of the features of both of the choices, and for -- further guidance how to choose between the two NTP daemons. -+ default), or services of the <tt>ntpd</tt> NTP daemon. - <br /> - To specify a remote NTP server for time synchronization, perform the following: - <ul> diff --git a/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/ansible/shared.yml b/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/ansible/shared.yml index e60dd11e..12f4bd92 100644 --- a/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/ansible/shared.yml @@ -8980,25 +2503,15 @@ index e60dd11e..12f4bd92 100644 # reboot = false # strategy = configure # complexity = low -diff --git a/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/bash/shared.sh b/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/bash/shared.sh -index 83acc51d..e7695a8c 100644 ---- a/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/bash/shared.sh -+++ b/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 7,multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 - - if grep -q 'OPTIONS=.*' /etc/sysconfig/chronyd; then - # trying to solve cases where the parameter after OPTIONS diff --git a/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/rule.yml b/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/rule.yml -index ef986781..93b9f3f2 100644 +index bce31f0e..d85d64ec 100644 --- a/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/rule.yml +++ b/linux_os/guide/services/ntp/chronyd_run_as_chrony_user/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,fedora,sle15 -+prodtype: rhel7,rhel8,almalinux8,fedora,sle15 +-prodtype: fedora,rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Ensure that chronyd is running under chrony user account' @@ -9086,120 +2599,79 @@ index fbe2933f..eea0c083 100644 echo "server " > /etc/chrony.conf -diff --git a/linux_os/guide/services/ntp/group.yml b/linux_os/guide/services/ntp/group.yml -index c5c78696..80e0b9a7 100644 ---- a/linux_os/guide/services/ntp/group.yml -+++ b/linux_os/guide/services/ntp/group.yml -@@ -48,22 +48,6 @@ description: |- - to use broadcast or multicast IP, or to perform authentication of packets with - the <tt>Autokey</tt> protocol, should consider using <tt>ntpd</tt>. - <br /><br /> -- Refer to -- {{% if product == "ol7" %}} -- {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-nettime.html") }}} -- {{% elif product == "rhel7" %}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}} -- {{% elif "ubuntu" in product %}} -- {{{ weblink(link="https://help.ubuntu.com/lts/serverguide/NTP.html") }}} -- {{% elif "debian" in product %}} -- {{{ weblink(link="https://wiki.debian.org/NTP") }}} -- {{% else %}} -- {{{ weblink(link="https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/servers/Configuring_NTP_Using_the_chrony_Suite/") }}} -- {{% endif %}} -- for more detailed comparison of features of <tt>chronyd</tt> -- and <tt>ntpd</tt> daemon features respectively, and for further guidance how to -- choose between the two NTP daemons. -- <br /><br /> - The upstream manual pages at {{{ weblink(link="http://chrony.tuxfamily.org/manual.html") }}} for - <tt>chronyd</tt> and {{{ weblink(link="http://www.ntp.org") }}} for <tt>ntpd</tt> provide additional - information on the capabilities and configuration of each of the NTP daemons. diff --git a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/bash/shared.sh b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/bash/shared.sh -index b81a539c..2c5a9298 100644 +index c95dccf9..b07b8798 100644 --- a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/bash/shared.sh +++ b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/bash/shared.sh @@ -1,4 +1,4 @@ -# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol +# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol - if rpm -q --quiet chrony ; then + if {{{ bash_package_installed("chrony") }}} ; then if ! /usr/sbin/pidof ntpd ; then diff --git a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml -index 056e3c67..6fce7c93 100644 +index 00739816..dc5def62 100644 --- a/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml +++ b/linux_os/guide/services/ntp/service_chronyd_or_ntpd_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhv4,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhv4,ubuntu2004 title: 'Enable the NTP Daemon' -@@ -11,13 +11,7 @@ description: |- - {{{ ocil_service_enabled(service="ntpd") }}} - Note: The <tt>ntpd</tt> daemon is not enabled by default. Though as mentioned - in the previous sections in certain environments the <tt>ntpd</tt> daemon might -- be preferred to be used rather than the <tt>chronyd</tt> one. Refer to: -- {{% if product in ["ol7", "ol8"] %}} -- {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-nettime.html") }}} -- {{% else %}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/ch-Configuring_NTP_Using_the_chrony_Suite.html") }}} -- {{% endif %}} -- for guidance which NTP daemon to choose depending on the environment used. -+ be preferred to be used rather than the <tt>chronyd</tt> one. - - rationale: |- - Enabling some of <tt>chronyd</tt> or <tt>ntpd</tt> services ensures diff --git a/linux_os/guide/services/obsolete/inetd_and_xinetd/package_xinetd_removed/rule.yml b/linux_os/guide/services/obsolete/inetd_and_xinetd/package_xinetd_removed/rule.yml -index debbca89..47c4cd60 100644 +index b582a3d6..5ee8c663 100644 --- a/linux_os/guide/services/obsolete/inetd_and_xinetd/package_xinetd_removed/rule.yml +++ b/linux_os/guide/services/obsolete/inetd_and_xinetd/package_xinetd_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Uninstall xinetd Package' diff --git a/linux_os/guide/services/obsolete/inetd_and_xinetd/service_xinetd_disabled/rule.yml b/linux_os/guide/services/obsolete/inetd_and_xinetd/service_xinetd_disabled/rule.yml -index b89c1092..bc6c622a 100644 +index 5583ef26..a114f271 100644 --- a/linux_os/guide/services/obsolete/inetd_and_xinetd/service_xinetd_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/inetd_and_xinetd/service_xinetd_disabled/rule.yml -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 + # package is unlikely to appear on a RHEL9 system, don't extend to RHEL10 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Disable xinetd Service' diff --git a/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml b/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml -index c58db2c8..9c73af93 100644 +index 87f57cda..a1b432ca 100644 --- a/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml +++ b/linux_os/guide/services/obsolete/nis/package_ypbind_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Remove NIS Client' diff --git a/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml b/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml -index c5733c0b..ac41f1fb 100644 +index d36144ea..df89ad6a 100644 --- a/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml +++ b/linux_os/guide/services/obsolete/nis/package_ypserv_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Uninstall ypserv Package' diff --git a/linux_os/guide/services/obsolete/nis/service_ypbind_disabled/rule.yml b/linux_os/guide/services/obsolete/nis/service_ypbind_disabled/rule.yml -index c4b50ed2..c1447093 100644 +index 29f66c6f..8a2e364f 100644 --- a/linux_os/guide/services/obsolete/nis/service_ypbind_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/nis/service_ypbind_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -9221,25 +2693,25 @@ index 26b3c514..f65fd861 100644 # Identify local mounts MOUNT_LIST=$(df --local | awk '{ print $6 }') diff --git a/linux_os/guide/services/obsolete/r_services/no_host_based_files/rule.yml b/linux_os/guide/services/obsolete/r_services/no_host_based_files/rule.yml -index 49445306..dfaaa718 100644 +index 6917a73b..56ebbc98 100644 --- a/linux_os/guide/services/obsolete/r_services/no_host_based_files/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/no_host_based_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019,sle15 title: 'Remove Host-Based Authentication Files' @@ -31,7 +31,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040550 stigid@rhel7: RHEL-07-040550 - stigid@sle12: SLES-12-010410 - stigid@rhel8: RHEL-08-010460 + stigid@almalinux8: RHEL-08-010460 - - ocil_clause: 'these files exist' + stigid@sle12: SLES-12-010410 + stigid@sle15: SLES-15-040030 diff --git a/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/ansible/shared.yml b/linux_os/guide/services/obsolete/r_services/no_rsh_trust_files/ansible/shared.yml index 7354a691..9f44e331 100644 @@ -9272,85 +2744,87 @@ index 6e902385..3a6461d6 100644 # Identify local mounts MOUNT_LIST=$(df --local | awk '{ print $6 }') diff --git a/linux_os/guide/services/obsolete/r_services/no_user_host_based_files/rule.yml b/linux_os/guide/services/obsolete/r_services/no_user_host_based_files/rule.yml -index efb63862..526ad1c0 100644 +index 545c0608..afb87693 100644 --- a/linux_os/guide/services/obsolete/r_services/no_user_host_based_files/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/no_user_host_based_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019,sle15 title: 'Remove User Host-Based Authentication Files' @@ -31,7 +31,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040540 stigid@rhel7: RHEL-07-040540 - stigid@sle12: SLES-12-010400 - stigid@rhel8: RHEL-08-010470 + stigid@almalinux8: RHEL-08-010470 - - ocil_clause: 'these files exist' + stigid@sle12: SLES-12-010400 + stigid@sle15: SLES-15-040020 diff --git a/linux_os/guide/services/obsolete/r_services/package_rsh-server_removed/rule.yml b/linux_os/guide/services/obsolete/r_services/package_rsh-server_removed/rule.yml -index 23d30cb5..36bd901e 100644 +index d7d088d3..fa4b6c86 100644 --- a/linux_os/guide/services/obsolete/r_services/package_rsh-server_removed/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/package_rsh-server_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004,wrlinux1019 title: 'Uninstall rsh-server Package' -@@ -34,7 +34,7 @@ references: - isa-62443-2009: 4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3 - cobit5: APO13.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.04,DSS05.02,DSS05.03,DSS05.05,DSS06.06 - cis-csc: 11,12,14,15,3,8,9 +@@ -36,7 +36,7 @@ references: + srg: SRG-OS-000095-GPOS-00049 + stigid@ol7: OL07-00-020000 + stigid@rhel7: RHEL-07-020000 - stigid@rhel8: RHEL-08-040010 + stigid@almalinux8: RHEL-08-040010 + stigid@ubuntu2004: UBTU-20-010406 {{{ complete_ocil_entry_package(package="rsh-server") }}} - diff --git a/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml b/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml -index 5337d256..2e5a14d0 100644 +index c1e7afcf..a0c8ffe0 100644 --- a/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/package_rsh_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Uninstall rsh Package' diff --git a/linux_os/guide/services/obsolete/r_services/service_rexec_disabled/rule.yml b/linux_os/guide/services/obsolete/r_services/service_rexec_disabled/rule.yml -index 862b6e56..6e5236a8 100644 +index 136571ce..c70437bf 100644 --- a/linux_os/guide/services/obsolete/r_services/service_rexec_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/service_rexec_disabled/rule.yml -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 + # potentially outdated requirement, rsh-server may not be a RHEL9 package +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable rexec Service' diff --git a/linux_os/guide/services/obsolete/r_services/service_rlogin_disabled/rule.yml b/linux_os/guide/services/obsolete/r_services/service_rlogin_disabled/rule.yml -index ef638e5a..13cc744e 100644 +index d6fa7eaf..e618c678 100644 --- a/linux_os/guide/services/obsolete/r_services/service_rlogin_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/service_rlogin_disabled/rule.yml -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 + # potentially obsolete, rsh-server is not available in RHEL9 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable rlogin Service' diff --git a/linux_os/guide/services/obsolete/r_services/service_rsh_disabled/rule.yml b/linux_os/guide/services/obsolete/r_services/service_rsh_disabled/rule.yml -index e061a10d..3adee025 100644 +index 70d6cb15..7241a8d0 100644 --- a/linux_os/guide/services/obsolete/r_services/service_rsh_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/r_services/service_rsh_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -9362,121 +2836,143 @@ index e061a10d..3adee025 100644 title: 'Disable rsh Service' diff --git a/linux_os/guide/services/obsolete/service_rsyncd_disabled/rule.yml b/linux_os/guide/services/obsolete/service_rsyncd_disabled/rule.yml -index 7cac07d9..678e416b 100644 +index addfd018..13ca156c 100644 --- a/linux_os/guide/services/obsolete/service_rsyncd_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/service_rsyncd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,ol7,rhel8,ol8,fedora,rhv4,rhcos4,sle15 -+prodtype: rhel7,ol7,rhel8,almalinux8,ol8,fedora,rhv4,rhcos4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Ensure rsyncd service is diabled' +diff --git a/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/disabled.pass.sh b/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/disabled.pass.sh +index 583d717f..9f256e72 100644 +--- a/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/disabled.pass.sh ++++ b/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/disabled.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Oracle Linux 8,multi_platform_fedora,multi_platform_rhv ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,multi_platform_fedora,multi_platform_rhv + # packages = rsync-daemon + + systemctl stop rsyncd +diff --git a/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/enabled.fail.sh b/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/enabled.fail.sh +index ce669993..bc728f24 100644 +--- a/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/enabled.fail.sh ++++ b/linux_os/guide/services/obsolete/service_rsyncd_disabled/tests/enabled.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Oracle Linux 8,multi_platform_fedora,multi_platform_rhv ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,multi_platform_fedora,multi_platform_rhv + # packages = rsync-daemon + + systemctl start rsyncd diff --git a/linux_os/guide/services/obsolete/talk/package_talk-server_removed/rule.yml b/linux_os/guide/services/obsolete/talk/package_talk-server_removed/rule.yml -index fb1760a2..c7fced93 100644 +index e0667d88..bcc22345 100644 --- a/linux_os/guide/services/obsolete/talk/package_talk-server_removed/rule.yml +++ b/linux_os/guide/services/obsolete/talk/package_talk-server_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Uninstall talk-server Package' diff --git a/linux_os/guide/services/obsolete/talk/package_talk_removed/rule.yml b/linux_os/guide/services/obsolete/talk/package_talk_removed/rule.yml -index 520bf799..a14f34de 100644 +index 592d56ce..51343ca2 100644 --- a/linux_os/guide/services/obsolete/talk/package_talk_removed/rule.yml +++ b/linux_os/guide/services/obsolete/talk/package_talk_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Uninstall talk Package' diff --git a/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml b/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml -index f42bcba1..83852d46 100644 +index d6e3d01f..61916185 100644 --- a/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml +++ b/linux_os/guide/services/obsolete/telnet/package_telnet-server_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Uninstall telnet-server Package' -@@ -44,7 +44,7 @@ references: - isa-62443-2009: 4.3.3.5.1,4.3.3.5.2,4.3.3.5.3,4.3.3.5.4,4.3.3.5.5,4.3.3.5.6,4.3.3.5.7,4.3.3.5.8,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.1,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.2,4.3.4.3.3 - cobit5: APO13.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.04,DSS05.02,DSS05.03,DSS05.05,DSS06.06 - cis-csc: 11,12,14,15,3,8,9 +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000095-GPOS-00049 + stigid@ol7: OL07-00-021710 + stigid@rhel7: RHEL-07-021710 - stigid@rhel8: RHEL-08-040000 + stigid@almalinux8: RHEL-08-040000 - - {{{ complete_ocil_entry_package(package="telnet-server") }}} + stigid@sle12: SLES-12-030000 + stigid@sle15: SLES-15-010180 diff --git a/linux_os/guide/services/obsolete/telnet/package_telnet_removed/rule.yml b/linux_os/guide/services/obsolete/telnet/package_telnet_removed/rule.yml -index a541ab5b..a887e7ee 100644 +index 18f5f11a..52f99449 100644 --- a/linux_os/guide/services/obsolete/telnet/package_telnet_removed/rule.yml +++ b/linux_os/guide/services/obsolete/telnet/package_telnet_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Remove telnet Clients' diff --git a/linux_os/guide/services/obsolete/telnet/service_telnet_disabled/rule.yml b/linux_os/guide/services/obsolete/telnet/service_telnet_disabled/rule.yml -index 38269b98..085136b0 100644 +index 36dd48df..bb497e0f 100644 --- a/linux_os/guide/services/obsolete/telnet/service_telnet_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/telnet/service_telnet_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable telnet Service' diff --git a/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml b/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml -index 2d0258db..5b0e5d92 100644 +index 0511b110..b2fc12a4 100644 --- a/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml +++ b/linux_os/guide/services/obsolete/tftp/package_tftp-server_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Uninstall tftp-server Package' -@@ -33,7 +33,7 @@ references: - cobit5: APO13.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.04,DSS05.02,DSS05.03,DSS05.05,DSS06.06 - iso27001-2013: A.11.2.6,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.2.1,A.6.2.2,A.9.1.2 - cis-csc: 11,12,14,15,3,8,9 +@@ -35,7 +35,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040700 + stigid@rhel7: RHEL-07-040700 - stigid@rhel8: RHEL-08-040190 + stigid@almalinux8: RHEL-08-040190 {{{ complete_ocil_entry_package(package="tftp-server") }}} diff --git a/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml b/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml -index f7a8ba35..55344fb2 100644 +index 50b22bb8..5c32712b 100644 --- a/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml +++ b/linux_os/guide/services/obsolete/tftp/package_tftp_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Remove tftp Daemon' diff --git a/linux_os/guide/services/obsolete/tftp/service_tftp_disabled/rule.yml b/linux_os/guide/services/obsolete/tftp/service_tftp_disabled/rule.yml -index 7cd0d99b..17708acd 100644 +index 1d6d6c81..f9aebbf5 100644 --- a/linux_os/guide/services/obsolete/tftp/service_tftp_disabled/rule.yml +++ b/linux_os/guide/services/obsolete/tftp/service_tftp_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -9509,7 +3005,7 @@ index cf090191..e84f7d1d 100644 . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/rule.yml b/linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/rule.yml -index 24cefbb6..2519abdf 100644 +index 75304d43..db6bc6c0 100644 --- a/linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/rule.yml +++ b/linux_os/guide/services/obsolete/tftp/tftpd_uses_secure_mode/rule.yml @@ -1,6 +1,6 @@ @@ -9521,16 +3017,16 @@ index 24cefbb6..2519abdf 100644 title: 'Ensure tftp Daemon Uses Secure Mode' @@ -38,7 +38,7 @@ references: - cobit5: APO01.06,APO13.01,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.04,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,DSS06.02,DSS06.06 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.11.2.6,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.1.2,A.6.2.1,A.6.2.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 11,12,13,14,15,16,18,3,5,8,9 + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040720 + stigid@rhel7: RHEL-07-040720 - stigid@rhel8: RHEL-08-040350 + stigid@almalinux8: RHEL-08-040350 ocil_clause: 'this flag is missing' diff --git a/linux_os/guide/services/printing/configure_printing/cups_disable_browsing/rule.yml b/linux_os/guide/services/printing/configure_printing/cups_disable_browsing/rule.yml -index c28ba338..dcc000e4 100644 +index 07e05068..99d2c008 100644 --- a/linux_os/guide/services/printing/configure_printing/cups_disable_browsing/rule.yml +++ b/linux_os/guide/services/printing/configure_printing/cups_disable_browsing/rule.yml @@ -1,6 +1,6 @@ @@ -9542,7 +3038,7 @@ index c28ba338..dcc000e4 100644 title: 'Disable Printer Browsing Entirely if Possible' diff --git a/linux_os/guide/services/printing/configure_printing/cups_disable_printserver/rule.yml b/linux_os/guide/services/printing/configure_printing/cups_disable_printserver/rule.yml -index 997c4b67..96dab0fc 100644 +index 0455776f..e37dae84 100644 --- a/linux_os/guide/services/printing/configure_printing/cups_disable_printserver/rule.yml +++ b/linux_os/guide/services/printing/configure_printing/cups_disable_printserver/rule.yml @@ -1,6 +1,6 @@ @@ -9554,67 +3050,67 @@ index 997c4b67..96dab0fc 100644 title: 'Disable Print Server Capabilities' diff --git a/linux_os/guide/services/printing/service_cups_disabled/rule.yml b/linux_os/guide/services/printing/service_cups_disabled/rule.yml -index 1f731586..a045da73 100644 +index dd72c6f7..00241a47 100644 --- a/linux_os/guide/services/printing/service_cups_disabled/rule.yml +++ b/linux_os/guide/services/printing/service_cups_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Disable the CUPS Service' diff --git a/linux_os/guide/services/proxy/disabling_squid/package_squid_removed/rule.yml b/linux_os/guide/services/proxy/disabling_squid/package_squid_removed/rule.yml -index 563cad46..62b0a7b4 100644 +index 4e661231..fb67f277 100644 --- a/linux_os/guide/services/proxy/disabling_squid/package_squid_removed/rule.yml +++ b/linux_os/guide/services/proxy/disabling_squid/package_squid_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Uninstall squid Package' diff --git a/linux_os/guide/services/proxy/disabling_squid/service_squid_disabled/rule.yml b/linux_os/guide/services/proxy/disabling_squid/service_squid_disabled/rule.yml -index 04d0a125..bbc840dc 100644 +index f12fa6f2..0b1a4ea5 100644 --- a/linux_os/guide/services/proxy/disabling_squid/service_squid_disabled/rule.yml +++ b/linux_os/guide/services/proxy/disabling_squid/service_squid_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,sle15 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable Squid' diff --git a/linux_os/guide/services/radius/package_freeradius_removed/rule.yml b/linux_os/guide/services/radius/package_freeradius_removed/rule.yml -index ebaea4ac..e30adcb3 100644 +index 7c01c09b..89f28d22 100644 --- a/linux_os/guide/services/radius/package_freeradius_removed/rule.yml +++ b/linux_os/guide/services/radius/package_freeradius_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Remove the FreeRadius Server Package' diff --git a/linux_os/guide/services/rng/service_rngd_enabled/rule.yml b/linux_os/guide/services/rng/service_rngd_enabled/rule.yml -index feebdff4..6567c748 100644 +index 274a4ff6..83b062a6 100644 --- a/linux_os/guide/services/rng/service_rngd_enabled/rule.yml +++ b/linux_os/guide/services/rng/service_rngd_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Enable the Hardware RNG Entropy Gatherer Service' -@@ -21,7 +21,7 @@ identifiers: - references: +@@ -23,7 +23,7 @@ references: + disa: CCI-000366 ospp: FCS_RBG_EXT.1 srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010471 @@ -9623,50 +3119,51 @@ index feebdff4..6567c748 100644 ocil_clause: 'the service is not enabled' diff --git a/linux_os/guide/services/routing/disabling_quagga/package_quagga_removed/rule.yml b/linux_os/guide/services/routing/disabling_quagga/package_quagga_removed/rule.yml -index 13bb7304..d3ca2eea 100644 +index b63deaa8..285c1b64 100644 --- a/linux_os/guide/services/routing/disabling_quagga/package_quagga_removed/rule.yml +++ b/linux_os/guide/services/routing/disabling_quagga/package_quagga_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall quagga Package' diff --git a/linux_os/guide/services/routing/disabling_quagga/service_zebra_disabled/rule.yml b/linux_os/guide/services/routing/disabling_quagga/service_zebra_disabled/rule.yml -index ef4a10d1..e60dd79c 100644 +index 8f76acc7..51dea573 100644 --- a/linux_os/guide/services/routing/disabling_quagga/service_zebra_disabled/rule.yml +++ b/linux_os/guide/services/routing/disabling_quagga/service_zebra_disabled/rule.yml -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 + # package is unlikely to appear on a RHEL9 system, don't extend to RHEL10 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable Quagga Service' diff --git a/linux_os/guide/services/smb/configuring_samba/mount_option_smb_client_signing/rule.yml b/linux_os/guide/services/smb/configuring_samba/mount_option_smb_client_signing/rule.yml -index 9c2b065e..55f08c6b 100644 +index da59b70a..c2835fba 100644 --- a/linux_os/guide/services/smb/configuring_samba/mount_option_smb_client_signing/rule.yml +++ b/linux_os/guide/services/smb/configuring_samba/mount_option_smb_client_signing/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Require Client SMB Packet Signing, if using mount.cifs' diff --git a/linux_os/guide/services/smb/configuring_samba/package_samba-common_installed/rule.yml b/linux_os/guide/services/smb/configuring_samba/package_samba-common_installed/rule.yml -index c83513b1..8efa81c0 100644 +index 1f7d56c1..4e5fb508 100644 --- a/linux_os/guide/services/smb/configuring_samba/package_samba-common_installed/rule.yml +++ b/linux_os/guide/services/smb/configuring_samba/package_samba-common_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,rhel7,rhel8,rhv4,sle15 -+prodtype: rhcos4,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Install the Samba Common Package' @@ -9715,50 +3212,50 @@ index 0cf80fb6..d9978cea 100644 title: 'Disable Root Access to SMB Shares' diff --git a/linux_os/guide/services/smb/disabling_samba/package_samba_removed/rule.yml b/linux_os/guide/services/smb/disabling_samba/package_samba_removed/rule.yml -index dcf23661..20a5dde3 100644 +index cd4634ac..15b48438 100644 --- a/linux_os/guide/services/smb/disabling_samba/package_samba_removed/rule.yml +++ b/linux_os/guide/services/smb/disabling_samba/package_samba_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Uninstall Samba Package' diff --git a/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml b/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml -index e5c7587b..1a1cc242 100644 +index 41375ebd..12bf35bf 100644 --- a/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml +++ b/linux_os/guide/services/smb/disabling_samba/service_smb_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,sle15 -+prodtype: rhel7,rhel8,almalinux8,sle15 +-prodtype: rhel7,rhel8,rhel9,sle15 ++prodtype: rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable Samba' diff --git a/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml b/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml -index 9fefec42..a1cc0101 100644 +index 6d30c0ea..49b44a61 100644 --- a/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml +++ b/linux_os/guide/services/snmp/disabling_snmp_service/package_net-snmp_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: debian10,debian9,fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: debian10,debian9,fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Uninstall net-snmp Package' diff --git a/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml b/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml -index 25483ab0..6447c54a 100644 +index 66a71f85..80ff0aab 100644 --- a/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml +++ b/linux_os/guide/services/snmp/disabling_snmp_service/service_snmpd_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: debian10,debian9,rhel7,rhel8,sle15 -+prodtype: debian10,debian9,rhel7,rhel8,almalinux8,sle15 +-prodtype: debian10,debian9,rhel7,rhel8,rhel9,sle15 ++prodtype: debian10,debian9,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable snmpd Service' @@ -9806,7 +3303,7 @@ index 4271bdc3..abbe006b 100644 . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/rule.yml b/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/rule.yml -index 1a5c929b..a15bac8a 100644 +index 19775b8c..dc6e7d8e 100644 --- a/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/rule.yml +++ b/linux_os/guide/services/snmp/snmp_configure_server/snmpd_not_default_password/rule.yml @@ -1,6 +1,6 @@ @@ -9818,78 +3315,78 @@ index 1a5c929b..a15bac8a 100644 title: 'Ensure Default SNMP Password Is Not Used' diff --git a/linux_os/guide/services/snmp/snmp_configure_server/snmpd_use_newer_protocol/rule.yml b/linux_os/guide/services/snmp/snmp_configure_server/snmpd_use_newer_protocol/rule.yml -index 776652a9..8cce8418 100644 +index 789f2264..ef5b6e8d 100644 --- a/linux_os/guide/services/snmp/snmp_configure_server/snmpd_use_newer_protocol/rule.yml +++ b/linux_os/guide/services/snmp/snmp_configure_server/snmpd_use_newer_protocol/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 title: 'Configure SNMP Service to Use Only SNMPv3 or Newer' diff --git a/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml b/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml -index 2b443f0d..7782532d 100644 +index 7cf916d7..efb01b6d 100644 --- a/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml +++ b/linux_os/guide/services/ssh/file_groupowner_sshd_config/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15,rhcos4 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15,rhcos4 +-prodtype: rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Group Who Owns SSH Server config file' diff --git a/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml b/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml -index 58eee9fa..bb3f95fc 100644 +index 5b833370..fb924e19 100644 --- a/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml +++ b/linux_os/guide/services/ssh/file_owner_sshd_config/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15,rhcos4 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15,rhcos4 +-prodtype: rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Owner on SSH Server config file' diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml -index 3abdc399..61620bf5 100644 +index 60783301..3a61e051 100644 --- a/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml +++ b/linux_os/guide/services/ssh/file_permissions_sshd_config/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4,sle15,rhcos4 -+prodtype: rhel7,rhel8,almalinux8,rhv4,sle15,rhcos4 +-prodtype: rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Verify Permissions on SSH Server config file' diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml -index 5397a3fd..a3194d48 100644 +index 4ea47383..b9afa0aa 100644 --- a/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml +++ b/linux_os/guide/services/ssh/file_permissions_sshd_private_key/rule.yml -@@ -35,7 +35,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 - cis@rhel8: 5.2.3 +@@ -39,7 +39,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040420 + stigid@rhel7: RHEL-07-040420 - stigid@rhel8: RHEL-08-010490 + stigid@almalinux8: RHEL-08-010490 - - ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/ssh/*_key", perms="-rw-r-----") }}}' + stigid@sle12: SLES-12-030220 + stigid@sle15: SLES-15-040250 diff --git a/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml b/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml -index d49e375d..eef32941 100644 +index a5ceac0e..3a777473 100644 --- a/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml +++ b/linux_os/guide/services/ssh/file_permissions_sshd_pub_key/rule.yml -@@ -30,7 +30,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 - cis@rhel8: 5.2.4 +@@ -34,7 +34,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040410 + stigid@rhel7: RHEL-07-040410 - stigid@rhel8: RHEL-08-010480 + stigid@almalinux8: RHEL-08-010480 - - ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/ssh/*.pub", perms="-rw-r--r--") }}}' + stigid@sle12: SLES-12-030210 + stigid@sle15: SLES-15-040240 diff --git a/linux_os/guide/services/ssh/firewalld_sshd_disabled/rule.yml b/linux_os/guide/services/ssh/firewalld_sshd_disabled/rule.yml index d49b5e58..a948b56c 100644 @@ -9904,133 +3401,135 @@ index d49b5e58..a948b56c 100644 title: 'Remove SSH Server firewalld Firewall exception (Unusual)' diff --git a/linux_os/guide/services/ssh/package_openssh-clients_installed/rule.yml b/linux_os/guide/services/ssh/package_openssh-clients_installed/rule.yml -index 2317d0d3..82475fc9 100644 +index d90a6482..791df38c 100644 --- a/linux_os/guide/services/ssh/package_openssh-clients_installed/rule.yml +++ b/linux_os/guide/services/ssh/package_openssh-clients_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true +-prodtype: ol8,rhel8,rhel9 ++prodtype: ol8,rhel8,almalinux8,rhel9 + + title: 'Install OpenSSH client software' + +diff --git a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml +index b551f08f..ae59870d 100644 +--- a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml ++++ b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml +@@ -30,7 +30,7 @@ references: + srg: SRG-OS-000423-GPOS-00187,SRG-OS-000424-GPOS-00188,SRG-OS-000425-GPOS-00189,SRG-OS-000426-GPOS-00190 + stigid@ol7: OL07-00-040300 + stigid@rhel7: RHEL-07-040300 +- stigid@rhel8: RHEL-08-040159 ++ stigid@almalinux8: RHEL-08-040159 + stigid@ubuntu2004: UBTU-20-010042 + + ocil_clause: 'the package is not installed' +diff --git a/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml b/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml +index ac4bb8e4..55a512b3 100644 +--- a/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml ++++ b/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 + + title: 'Enable the OpenSSH Service' + +@@ -40,7 +40,7 @@ references: + srg: SRG-OS-000423-GPOS-00187,SRG-OS-000423-GPOS-00188,SRG-OS-000423-GPOS-00189,SRG-OS-000423-GPOS-00190 + stigid@ol7: OL07-00-040310 + stigid@rhel7: RHEL-07-040310 +- stigid@rhel8: RHEL-08-040160 ++ stigid@almalinux8: RHEL-08-040160 + stigid@sle12: SLES-12-030100 + stigid@sle15: SLES-15-010530 + stigid@ubuntu2004: UBTU-20-010042 +diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml +index f43f92c2..bba72681 100644 +--- a/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml ++++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_rekey_limit/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: ol8,rhel8,rhcos4 ++prodtype: ol8,rhel8,almalinux8,rhcos4 + + title: 'Configure session renegotiation for SSH client' + +diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml +index 1c878701..be1bff4c 100644 +--- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml ++++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,Oracle Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh +index f29280fb..f2d7c156 100644 +--- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh ++++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Oracle Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 + + # put line into the file + echo "setenv SSH_USE_STRONG_RNG 32" > /etc/profile.d/cc-ssh-strong-rng.csh +diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml +index cbd17bf0..6b50d0a8 100644 +--- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml ++++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + -prodtype: ol8,rhel8 +prodtype: ol8,rhel8,almalinux8 - title: 'Install OpenSSH client software' - -diff --git a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml -index 84882d52..76385dcb 100644 ---- a/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml -+++ b/linux_os/guide/services/ssh/package_openssh-server_installed/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: debian10,debian9,fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,ubuntu1604,ubuntu1804,ubuntu2004,wrlinux1019,wrlinux8 -+prodtype: debian10,debian9,fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu1604,ubuntu1804,ubuntu2004,wrlinux1019,wrlinux8 - - title: 'Install the OpenSSH Server Package' - -diff --git a/linux_os/guide/services/ssh/package_openssh-server_removed/rule.yml b/linux_os/guide/services/ssh/package_openssh-server_removed/rule.yml -index f866b98a..a0c0217e 100644 ---- a/linux_os/guide/services/ssh/package_openssh-server_removed/rule.yml -+++ b/linux_os/guide/services/ssh/package_openssh-server_removed/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: debian10,debian9,fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,ubuntu1604,ubuntu1804,ubuntu2004,wrlinux1019,wrlinux8 -+prodtype: debian10,debian9,fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu1604,ubuntu1804,ubuntu2004,wrlinux1019,wrlinux8 - - title: 'Remove the OpenSSH Server Package' - -diff --git a/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml b/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml -index 81d63480..5e18df04 100644 ---- a/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml -+++ b/linux_os/guide/services/ssh/service_sshd_enabled/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 - - title: 'Enable the OpenSSH Service' - -@@ -38,7 +38,7 @@ references: - cobit5: APO01.06,DSS05.02,DSS05.04,DSS05.07,DSS06.02,DSS06.06 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 13,14 -- stigid@rhel8: RHEL-08-040160 -+ stigid@almalinux8: RHEL-08-040160 - - ocil: '{{{ ocil_service_enabled(service="sshd") }}}' - -diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml -index a9f579ae..d09aa306 100644 ---- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml -+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/ansible/shared.yml -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 - # reboot = false - # strategy = configure - # complexity = low -diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh -index a3b0b3a9..8859fb92 100644 ---- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh -+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/bash/shared.sh -@@ -1,5 +1,5 @@ - #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 - - # put line into the file - echo "setenv SSH_USE_STRONG_RNG 32" > /etc/profile.d/cc-ssh-strong-rng.csh -diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml -index a2b9bfa3..690daa63 100644 ---- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml -+++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_csh/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: rhel8 -+prodtype: rhel8,almalinux8 - title: 'SSH client uses strong entropy to seed (for CSH like shells)' diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/ansible/shared.yml -index d19ee819..2500acf8 100644 +index 29c64602..1be957f9 100644 --- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/ansible/shared.yml +++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Oracle Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 # reboot = false # strategy = configure # complexity = low diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/bash/shared.sh b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/bash/shared.sh -index 07e45f1d..5d3721f9 100644 +index 4a166356..24a426a5 100644 --- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/bash/shared.sh +++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/bash/shared.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Oracle Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 # put line into the file echo "export SSH_USE_STRONG_RNG=32" > /etc/profile.d/cc-ssh-strong-rng.sh diff --git a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/rule.yml b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/rule.yml -index 3de4df0a..c912cee2 100644 +index 53728a2b..6021e093 100644 --- a/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/rule.yml +++ b/linux_os/guide/services/ssh/ssh_client/ssh_client_use_strong_rng_sh/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8 -+prodtype: rhel8,almalinux8 +-prodtype: ol8,rhel8 ++prodtype: ol8,rhel8,almalinux8 title: 'SSH client uses strong entropy to seed (Bash-like shells)' diff --git a/linux_os/guide/services/ssh/ssh_server/disable_host_auth/kubernetes/shared.yml b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/kubernetes/shared.yml -index ad3a41fc..99479ba5 100644 +index 5a97f74d..104b27f3 100644 --- a/linux_os/guide/services/ssh/ssh_server/disable_host_auth/kubernetes/shared.yml +++ b/linux_os/guide/services/ssh/ssh_server/disable_host_auth/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 @@ -10047,14 +3546,14 @@ index 2553a4d2..034183d2 100644 # complexity = low # strategy = configure diff --git a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml -index 6e38d595..9a2c544c 100644 +index 4945d060..050ce57c 100644 --- a/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Enable SSH Server firewalld Firewall Exception' @@ -10078,19 +3577,6 @@ index 590e96d1..b310e547 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions -diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/rule.yml -index fc6175e4..ffc3cbb5 100644 ---- a/linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/rule.yml -+++ b/linux_os/guide/services/ssh/ssh_server/sshd_allow_only_protocol2/rule.yml -@@ -41,7 +41,7 @@ references: - iso27001-2013: A.11.2.6,A.13.1.1,A.13.2.1,A.14.1.3,A.18.1.4,A.6.2.1,A.6.2.2,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5,8 - ism: 0487,1449,1506 -- stigid@rhel8: RHEL-08-040060 -+ stigid@almalinux8: RHEL-08-040060 - - ocil_clause: 'it is commented out or is not set correctly to Protocol 2' - diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/ansible/shared.yml index f8d422c6..aafcd046 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/ansible/shared.yml @@ -10112,31 +3598,57 @@ index 408c97d4..108868fc 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml -index 9e4e2f48..08b2fbe8 100644 +index 672bcabd..bf25eb57 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_compression/rule.yml @@ -39,7 +39,7 @@ references: - cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05 - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040470 + stigid@rhel7: RHEL-07-040470 - stigid@rhel8: RHEL-08-010510 + stigid@almalinux8: RHEL-08-010510 - - ocil_clause: 'it is commented out, or is not set to no or delayed' - + stigid@sle12: SLES-12-030250 + stigid@sle15: SLES-15-040280 + vmmsrg: SRG-OS-000480-VMM-002000 +diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml +index 8100b685..a4ec7a24 100644 +--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml ++++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_empty_passwords/rule.yml +@@ -47,7 +47,7 @@ references: + srg: SRG-OS-000106-GPOS-00053,SRG-OS-000480-GPOS-00229,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-010300 + stigid@rhel7: RHEL-07-010300 +- stigid@rhel8: RHEL-08-020330 ++ stigid@almalinux8: RHEL-08-020330 + stigid@sle12: SLES-12-030150 + stigid@sle15: SLES-15-040440 + stigid@ubuntu2004: UBTU-20-010047 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml -index f9ece13f..eb56fa9c 100644 +index 2134da28..e980b9e1 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_gssapi_auth/rule.yml @@ -36,7 +36,7 @@ references: - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 - ism: 0418,1055,1402 -- stigid@rhel8: RHEL-08-010521 -+ stigid@almalinux8: RHEL-08-010521 + srg: SRG-OS-000364-GPOS-00151,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040430 + stigid@rhel7: RHEL-07-040430 +- stigid@rhel8: RHEL-08-010522 ++ stigid@almalinux8: RHEL-08-010522 + vmmsrg: SRG-OS-000480-VMM-002000 ocil_clause: 'it is commented out or is not disabled' +diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_kerb_auth/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_kerb_auth/rule.yml +index 5f585d6c..40d0424e 100644 +--- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_kerb_auth/rule.yml ++++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_kerb_auth/rule.yml +@@ -37,7 +37,7 @@ references: + srg: SRG-OS-000364-GPOS-00151,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040440 + stigid@rhel7: RHEL-07-040440 +- stigid@rhel8: RHEL-08-010521 ++ stigid@almalinux8: RHEL-08-010521 + vmmsrg: SRG-OS-000480-VMM-002000 + ocil_clause: 'it is commented out or is not disabled' diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts_rsa/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts_rsa/ansible/shared.yml index 228a1166..6ba91af4 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_rhosts_rsa/ansible/shared.yml @@ -10158,104 +3670,104 @@ index 319ec5cb..93a302d8 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml -index 8360f5fa..5e32ab01 100644 +index 9993d5f8..692ac40c 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_root_login/rule.yml -@@ -46,7 +46,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.18.1.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,3,5 - anssi: BP28(R19),NT007(R21) +@@ -47,7 +47,7 @@ references: + srg: SRG-OS-000109-GPOS-00056,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040370 + stigid@rhel7: RHEL-07-040370 - stigid@rhel8: RHEL-08-010550 + stigid@almalinux8: RHEL-08-010550 - - {{{ complete_ocil_entry_sshd_option(default="no", option="PermitRootLogin", value="no") }}} - + stigid@sle12: SLES-12-030140 + stigid@sle15: SLES-15-020040 + vmmsrg: SRG-OS-000480-VMM-002000 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_user_known_hosts/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_user_known_hosts/rule.yml -index b55e7491..0eecd973 100644 +index 027fc4e7..1756277e 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_user_known_hosts/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_user_known_hosts/rule.yml -@@ -38,7 +38,7 @@ references: - cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05 - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 +@@ -39,7 +39,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040380 + stigid@rhel7: RHEL-07-040380 - stigid@rhel8: RHEL-08-010520 + stigid@almalinux8: RHEL-08-010520 - - {{{ complete_ocil_entry_sshd_option(default="no", option="IgnoreUserKnownHosts", value="yes") }}} + stigid@sle12: SLES-12-030200 + stigid@sle15: SLES-15-040230 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml -index 14f0270c..4f02e10e 100644 +index 3feaa9d6..95457e1d 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_disable_x11_forwarding/rule.yml -@@ -37,7 +37,7 @@ references: +@@ -41,7 +41,7 @@ references: srg: SRG-OS-000480-GPOS-00227 - disa: CCI-000366 - nist: CM-6(b) + stigid@ol7: OL07-00-040710 + stigid@rhel7: RHEL-07-040710 - stigid@rhel8: RHEL-08-040340 + stigid@almalinux8: RHEL-08-040340 + stigid@sle15: SLES-15-040290 + stigid@ubuntu2004: UBTU-20-010048 - template: - name: sshd_lineinfile diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml -index b1d33d3f..77e493e0 100644 +index 791ff49a..383141d3 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_do_not_permit_user_env/rule.yml -@@ -39,7 +39,7 @@ references: - cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05 - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 +@@ -41,7 +41,7 @@ references: + srg: SRG-OS-000480-GPOS-00229 + stigid@ol7: OL07-00-010460 + stigid@rhel7: RHEL-07-010460 - stigid@rhel8: RHEL-08-010830 + stigid@almalinux8: RHEL-08-010830 - - ocil_clause: 'PermitUserEnvironment is not disabled' - + stigid@sle12: SLES-12-030151 + stigid@sle15: SLES-15-040440 + stigid@ubuntu2004: UBTU-20-010047 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml -index 9eeb8f89..fa24d532 100644 +index dc8ef0d9..dc19af07 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_strictmodes/rule.yml -@@ -36,7 +36,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -37,7 +37,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040450 + stigid@rhel7: RHEL-07-040450 - stigid@rhel8: RHEL-08-010500 + stigid@almalinux8: RHEL-08-010500 - - ocil_clause: 'it is commented out or is not enabled' - + stigid@sle12: SLES-12-030230 + stigid@sle15: SLES-15-040260 + vmmsrg: SRG-OS-000480-VMM-002000 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml -index 2eb688c1..bb039742 100644 +index c50c8d69..6a0332cf 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_warning_banner/rule.yml @@ -43,7 +43,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 + srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007,SRG-OS-000228-GPOS-00088 + stigid@ol7: OL07-00-040170 + stigid@rhel7: RHEL-07-040170 - stigid@rhel8: RHEL-08-010040 + stigid@almalinux8: RHEL-08-010040 - - {{{ complete_ocil_entry_sshd_option(default="no", option="Banner", value="/etc/issue") }}} - + stigid@sle12: SLES-12-030050 + stigid@sle15: SLES-15-010040 + vmmsrg: SRG-OS-000023-VMM-000060,SRG-OS-000024-VMM-000070 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml -index cb15b1e9..61113719 100644 +index 80e9d455..5231e81b 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_print_last_log/rule.yml -@@ -32,7 +32,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 +@@ -33,7 +33,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040360 + stigid@rhel7: RHEL-07-040360 - stigid@rhel8: RHEL-08-020350 + stigid@almalinux8: RHEL-08-020350 - - ocil_clause: 'it is commented out or is not enabled' + stigid@sle12: SLES-12-030130 + stigid@sle15: SLES-15-020120 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml -index f3f15251..2c086bc4 100644 +index 5a2d154d..0b065076 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_rekey_limit/rule.yml -@@ -22,7 +22,7 @@ identifiers: - references: +@@ -24,7 +24,7 @@ references: + disa: CCI-000068 ospp: FCS_SSHS_EXT.1 - srg: SRG-OS-000480-GPOS-00227 + srg: SRG-OS-000480-GPOS-00227,SRG-OS-000033-GPOS-00014 - stigid@rhel8: RHEL-08-040161 + stigid@almalinux8: RHEL-08-040161 @@ -10282,18 +3794,51 @@ index 5b54ab89..4213bc15 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml -index 19151f02..48308d6e 100644 +index 5a442550..6c5e8548 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_idle_timeout/rule.yml -@@ -52,7 +52,7 @@ references: - iso27001-2013: A.12.4.1,A.12.4.3,A.14.1.1,A.14.2.1,A.14.2.5,A.18.1.4,A.6.1.2,A.6.1.5,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,12,13,14,15,16,18,3,5,7,8 - anssi: BP28(R29) +@@ -53,7 +53,7 @@ references: + srg: SRG-OS-000126-GPOS-00066,SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109,SRG-OS-000395-GPOS-00175 + stigid@ol7: OL07-00-040320 + stigid@rhel7: RHEL-07-040320 +- stigid@rhel8: RHEL-08-010201 ++ stigid@almalinux8: RHEL-08-010201 + stigid@sle12: SLES-12-030190 + stigid@sle15: SLES-15-010280 + stigid@ubuntu2004: UBTU-20-010037 +diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/ansible/shared.yml +index b280e21e..8e1c1810 100644 +--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/ansible/shared.yml ++++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/bash/shared.sh b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/bash/shared.sh +index 19b14c14..6f9fb212 100644 +--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/bash/shared.sh ++++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle,multi_platform_ubuntu + + # Include source function library. + . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml +index 3ce782bc..a02c1194 100644 +--- a/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml ++++ b/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml +@@ -50,7 +50,7 @@ references: + srg: SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109 + stigid@ol7: OL07-00-040340 + stigid@rhel7: RHEL-07-040340 - stigid@rhel8: RHEL-08-010200 + stigid@almalinux8: RHEL-08-010200 - - requires: - - sshd_set_keepalive + stigid@sle12: SLES-12-030191 + stigid@sle15: SLES-15-010320 + vmmsrg: SRG-OS-000480-VMM-002000 diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/ansible/shared.yml b/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/ansible/shared.yml index 16e31302..71125a8d 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_set_max_auth_tries/ansible/shared.yml @@ -10337,26 +3882,26 @@ index bc0c4784..3b775739 100644 #!/bin/bash SSHD_CONFIG="/etc/ssh/sshd_config" diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml -index 42cb32e3..42ad288e 100644 +index 46a31548..0250b71d 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_ciphers/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,wrlinux1019,wrlinux8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,wrlinux1019,wrlinux8 +-prodtype: ol7,ol8,rhel7,rhel8,sle12,ubuntu2004,wrlinux1019,wrlinux8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,sle12,ubuntu2004,wrlinux1019,wrlinux8 title: 'Use Only FIPS 140-2 Validated Ciphers' diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml -index 13997f94..12ae0f32 100644 +index 821b0ae0..b437a257 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_approved_macs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,sle12,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,sle12,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,sle12,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,sle12,ubuntu2004,wrlinux1019 title: 'Use Only FIPS 140-2 Validated MACs' @@ -10399,18 +3944,27 @@ index 8d33596e..beafbd6d 100644 sed -i 's/^\s*MACs\s/# &/i' /etc/ssh/sshd_config diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_rng/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_rng/rule.yml -index 85999877..907445e2 100644 +index bd9c5fbe..32f49012 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_rng/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_rng/rule.yml @@ -2,7 +2,7 @@ documentation_complete: true # TODO: The plan is not to need this for RHEL>=8.4 # TODO: Compliant setting is SSH_USE_STRONG_RNG set to 32 or more --prodtype: rhel8 -+prodtype: rhel8,almalinux8 +-prodtype: ol8,rhel8 ++prodtype: ol8,rhel8,almalinux8 title: 'SSH server uses strong entropy to seed' +@@ -27,7 +27,7 @@ references: + disa: CCI-000366 + ospp: FCS_RBG_EXT.1.2 + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-010292 ++ stigid@almalinux8: RHEL-08-010292 + + ocil: |- + To determine whether the SSH service is configured to use strong entropy seed, diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_rng/tests/bad_config.fail.sh b/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_rng/tests/bad_config.fail.sh index f4f8c22f..1884e87d 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_use_strong_rng/tests/bad_config.fail.sh @@ -10448,44 +4002,26 @@ index a10d24a7..d0b4e3a9 100644 echo 'SSH_USE_STRONG_RNG="32"' > /etc/sysconfig/sshd diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml -index 664db5e6..83c1cb29 100644 +index 93b612c6..b0e4f6a7 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_x11_use_localhost/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,sle12,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle12,ubuntu2004 title: 'Prevent remote hosts from connecting to the proxy display' -@@ -30,7 +30,7 @@ references: - stig@ol7: OL07-00-040711 - disa: CCI-000366 - nist: CM-6(b) +@@ -31,7 +31,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040711 + stigid@rhel7: RHEL-07-040711 - stigid@rhel8: RHEL-08-040341 + stigid@almalinux8: RHEL-08-040341 + stigid@sle12: SLES-12-030261 + stigid@ubuntu2004: UBTU-20-010049 - ocil_clause: "the display proxy is listening on wildcard address" - -diff --git a/linux_os/guide/services/sssd/group.yml b/linux_os/guide/services/sssd/group.yml -index c093cd34..cdbcfd8c 100644 ---- a/linux_os/guide/services/sssd/group.yml -+++ b/linux_os/guide/services/sssd/group.yml -@@ -9,13 +9,5 @@ description: |- - support to systems utilizing SSSD. SSSD using caching to reduce load on authentication - servers permit offline authentication as well as store extended user data. - <br /><br /> -- For more information, see -- {{%- if product == "rhel7" -%}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/SSSD.html") }}} -- {{%- elif product == "rhel8" -%}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/installing-an-ipa-client-basic-scenario_installing-identity-management#sssd-deployment-operations_install-client-basic") }}} -- {{%- elif product == "ol7" -%}} -- {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-sssd-auth.html") }}} -- {{%- endif %}} - - platform: sssd diff --git a/linux_os/guide/services/sssd/package_sssd-ipa_installed/rule.yml b/linux_os/guide/services/sssd/package_sssd-ipa_installed/rule.yml index ec0cf86d..dce874ce 100644 --- a/linux_os/guide/services/sssd/package_sssd-ipa_installed/rule.yml @@ -10499,7 +4035,7 @@ index ec0cf86d..dce874ce 100644 title: 'Install sssd-ipa Package' diff --git a/linux_os/guide/services/sssd/package_sssd_installed/rule.yml b/linux_os/guide/services/sssd/package_sssd_installed/rule.yml -index 137177c7..ab2ba445 100644 +index 0b683c07..8ab70a39 100644 --- a/linux_os/guide/services/sssd/package_sssd_installed/rule.yml +++ b/linux_os/guide/services/sssd/package_sssd_installed/rule.yml @@ -1,6 +1,6 @@ @@ -10511,7 +4047,7 @@ index 137177c7..ab2ba445 100644 title: 'Install the SSSD Package' diff --git a/linux_os/guide/services/sssd/service_sssd_enabled/rule.yml b/linux_os/guide/services/sssd/service_sssd_enabled/rule.yml -index 0ee77aae..e49a0e31 100644 +index 123d5ee0..8806239f 100644 --- a/linux_os/guide/services/sssd/service_sssd_enabled/rule.yml +++ b/linux_os/guide/services/sssd/service_sssd_enabled/rule.yml @@ -1,6 +1,6 @@ @@ -10523,7 +4059,7 @@ index 0ee77aae..e49a0e31 100644 title: 'Enable the SSSD Service' diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml -index a0567424..90db9075 100644 +index 01a2cdb1..c2cb1cbf 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca/rule.yml @@ -1,6 +1,6 @@ @@ -10555,7 +4091,7 @@ index 614f597e..1c617584 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml -index 570aa1ba..27cc0264 100644 +index 430f0e65..c78b10d6 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_ca_dir/rule.yml @@ -1,6 +1,6 @@ @@ -10587,7 +4123,7 @@ index 62c2febc..ce073f12 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml -index 731b7c08..f8010bbe 100644 +index 4b9636fb..46b8d977 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_configure_tls_reqcert/rule.yml @@ -1,6 +1,6 @@ @@ -10619,7 +4155,7 @@ index 805f7ad3..6046494d 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml -index 452de1d0..020bbad1 100644 +index 1f48dc7e..4872f285 100644 --- a/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml +++ b/linux_os/guide/services/sssd/sssd-ldap/sssd_ldap_start_tls/rule.yml @@ -1,6 +1,6 @@ @@ -10630,8 +4166,29 @@ index 452de1d0..020bbad1 100644 title: 'Configure SSSD LDAP Backend to Use TLS For All Transactions' +diff --git a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml +index 67c02f4f..28d15851 100644 +--- a/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml ++++ b/linux_os/guide/services/sssd/sssd_enable_certmap/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8 ++prodtype: fedora,rhel8,almalinux8 + + title: 'Enable Certmap in SSSD' + +@@ -29,7 +29,7 @@ references: + disa: CCI-000187 + nist: IA-5 (2) (c) + srg: SRG-OS-000068-GPOS-00036 +- stigid@rhel8: RHEL-08-020090 ++ stigid@almalinux8: RHEL-08-020090 + + warnings: + - general: |- diff --git a/linux_os/guide/services/sssd/sssd_enable_pam_services/bash/shared.sh b/linux_os/guide/services/sssd/sssd_enable_pam_services/bash/shared.sh -index 3c029111..938c719f 100644 +index 680ad113..fe5ace89 100644 --- a/linux_os/guide/services/sssd/sssd_enable_pam_services/bash/shared.sh +++ b/linux_os/guide/services/sssd/sssd_enable_pam_services/bash/shared.sh @@ -1,4 +1,4 @@ @@ -10641,7 +4198,7 @@ index 3c029111..938c719f 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/sssd/sssd_enable_pam_services/rule.yml b/linux_os/guide/services/sssd/sssd_enable_pam_services/rule.yml -index 426635c8..f0e5aec4 100644 +index 984ee37a..dcc31030 100644 --- a/linux_os/guide/services/sssd/sssd_enable_pam_services/rule.yml +++ b/linux_os/guide/services/sssd/sssd_enable_pam_services/rule.yml @@ -1,6 +1,6 @@ @@ -10673,33 +4230,33 @@ index ddd141f0..ee070eb3 100644 # strategy = configure # complexity = low diff --git a/linux_os/guide/services/sssd/sssd_enable_smartcards/rule.yml b/linux_os/guide/services/sssd/sssd_enable_smartcards/rule.yml -index bcf9d58e..81ee8f3c 100644 +index a3a8c636..4a55e1dc 100644 --- a/linux_os/guide/services/sssd/sssd_enable_smartcards/rule.yml +++ b/linux_os/guide/services/sssd/sssd_enable_smartcards/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,rhcos4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,rhcos4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,rhcos4 title: 'Enable Smartcards in SSSD' @@ -38,7 +38,7 @@ references: - srg: SRG-OS-000375-GPOS-00160 - vmmsrg: SRG-OS-000107-VMM-000530 + disa: CCI-001954,CCI-000765 ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 + srg: SRG-OS-000375-GPOS-00160,SRG-OS-000105-GPOS-00052 - stigid@rhel8: RHEL-08-020250 + stigid@almalinux8: RHEL-08-020250 + vmmsrg: SRG-OS-000107-VMM-000530 ocil_clause: 'smart cards are not enabled in SSSD' - diff --git a/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml -index dd89d1f4..ab897c72 100644 +index 7cfba003..fb36bb09 100644 --- a/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml +++ b/linux_os/guide/services/sssd/sssd_memcache_timeout/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -10714,60 +4271,60 @@ index 8bc689da..e697f252 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/sssd/sssd_memcache_timeout/rule.yml b/linux_os/guide/services/sssd/sssd_memcache_timeout/rule.yml -index 457a25be..f7993498 100644 +index ae98eb6e..ef2e1802 100644 --- a/linux_os/guide/services/sssd/sssd_memcache_timeout/rule.yml +++ b/linux_os/guide/services/sssd/sssd_memcache_timeout/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15 title: 'Configure SSSD''s Memory Cache to Expire' diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml -index 585d5114..349c94a4 100644 +index ebdf0136..73916d8d 100644 --- a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml +++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_sle # reboot = false # strategy = configure # complexity = low diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/bash/shared.sh b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/bash/shared.sh -index dbc68b00..da10c2c4 100644 +index 8a20f0c5..42987796 100644 --- a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/bash/shared.sh +++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_sle # reboot = false # strategy = configure # complexity = low diff --git a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/rule.yml b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/rule.yml -index 09ee5187..74866001 100644 +index 56996e52..fb9c327b 100644 --- a/linux_os/guide/services/sssd/sssd_offline_cred_expiration/rule.yml +++ b/linux_os/guide/services/sssd/sssd_offline_cred_expiration/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhv4,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu2004 title: 'Configure SSSD to Expire Offline Credentials' -@@ -36,7 +36,7 @@ references: - cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 +@@ -37,7 +37,7 @@ references: + nist: CM-6(a),IA-5(13) + nist-csf: PR.AC-1,PR.AC-6,PR.AC-7 + srg: SRG-OS-000383-GPOS-00166 - stigid@rhel8: RHEL-08-020290 + stigid@almalinux8: RHEL-08-020290 - - ocil_clause: 'it does not exist or is not configured properly' - + stigid@sle12: SLES-12-010680 + stigid@sle15: SLES-15-010500 + stigid@ubuntu2004: UBTU-20-010441 diff --git a/linux_os/guide/services/sssd/sssd_run_as_sssd_user/bash/shared.sh b/linux_os/guide/services/sssd/sssd_run_as_sssd_user/bash/shared.sh -index e46d5aea..1d2a6f3d 100644 +index 12ad20b8..1a2df72e 100644 --- a/linux_os/guide/services/sssd/sssd_run_as_sssd_user/bash/shared.sh +++ b/linux_os/guide/services/sssd/sssd_run_as_sssd_user/bash/shared.sh @@ -1,4 +1,4 @@ @@ -10775,9 +4332,9 @@ index e46d5aea..1d2a6f3d 100644 +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol found=false - for f in $( ls /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf 2> /dev/null ) ; do + for f in /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf; do diff --git a/linux_os/guide/services/sssd/sssd_run_as_sssd_user/rule.yml b/linux_os/guide/services/sssd/sssd_run_as_sssd_user/rule.yml -index 30599cf5..ef9dac61 100644 +index b5e841d8..35dc3d00 100644 --- a/linux_os/guide/services/sssd/sssd_run_as_sssd_user/rule.yml +++ b/linux_os/guide/services/sssd/sssd_run_as_sssd_user/rule.yml @@ -1,6 +1,6 @@ @@ -10809,7 +4366,7 @@ index e957d1c6..baadbdef 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/rule.yml b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/rule.yml -index 83b30c9d..59135b29 100644 +index 9390dfd4..18970027 100644 --- a/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/rule.yml +++ b/linux_os/guide/services/sssd/sssd_ssh_known_hosts_timeout/rule.yml @@ -1,6 +1,6 @@ @@ -10820,20 +4377,29 @@ index 83b30c9d..59135b29 100644 title: 'Configure SSSD to Expire SSH Known Hosts' +diff --git a/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/kubernetes/shared.yml b/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/kubernetes/shared.yml +index a1e83870..e097b6be 100644 +--- a/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/kubernetes/shared.yml ++++ b/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/kubernetes/shared.yml +@@ -1,3 +1,3 @@ + --- +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos + {{{ kubernetes_usbguard_set(["xccdf_org.ssgproject.content_rule_package_usbguard_installed"]) }}} diff --git a/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/rule.yml b/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/rule.yml -index b2fc36bb..eee7c168 100644 +index 59ca09ef..c9c0a141 100644 --- a/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/rule.yml +++ b/linux_os/guide/services/usbguard/configure_usbguard_auditbackend/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Log USBGuard daemon audit events using Linux Audit' -@@ -23,7 +23,7 @@ identifiers: - references: +@@ -25,7 +25,7 @@ references: + disa: CCI-000169 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000062-GPOS-00031 - stigid@rhel8: RHEL-08-030603 @@ -10841,115 +4407,167 @@ index b2fc36bb..eee7c168 100644 ocil_clause: 'AuditBackend is not set to LinuxAudit' +diff --git a/linux_os/guide/services/usbguard/package_usbguard_installed/kubernetes/shared.yml b/linux_os/guide/services/usbguard/package_usbguard_installed/kubernetes/shared.yml +index d9ea0648..03256e44 100644 +--- a/linux_os/guide/services/usbguard/package_usbguard_installed/kubernetes/shared.yml ++++ b/linux_os/guide/services/usbguard/package_usbguard_installed/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos + apiVersion: machineconfiguration.openshift.io/v1 + kind: MachineConfig + spec: diff --git a/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml b/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml -index f23176d8..812ec16a 100644 +index 19ef8aac..e5b47db3 100644 --- a/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml +++ b/linux_os/guide/services/usbguard/package_usbguard_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install usbguard Package' +@@ -48,7 +48,7 @@ references: + disa: CCI-001958 + ism: "1418" + srg: SRG-OS-000378-GPOS-00163 +- stigid@rhel8: RHEL-08-040139 ++ stigid@almalinux8: RHEL-08-040139 + + ocil_clause: 'the package is not installed' + +diff --git a/linux_os/guide/services/usbguard/service_usbguard_enabled/kubernetes/shared.yml b/linux_os/guide/services/usbguard/service_usbguard_enabled/kubernetes/shared.yml +index 9f1c7879..de556cd5 100644 +--- a/linux_os/guide/services/usbguard/service_usbguard_enabled/kubernetes/shared.yml ++++ b/linux_os/guide/services/usbguard/service_usbguard_enabled/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos + apiVersion: machineconfiguration.openshift.io/v1 + kind: MachineConfig + metadata: diff --git a/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml b/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml -index 918a2994..fe8aa1ff 100644 +index 4f008129..1a9fdfed 100644 --- a/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml +++ b/linux_os/guide/services/usbguard/service_usbguard_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Enable the USBGuard Service' -@@ -24,7 +24,7 @@ references: +@@ -27,7 +27,7 @@ references: + nist: CM-8(3)(a),IA-3 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000378-GPOS-00163 - ism: "1418" -- stigid@rhel8: RHEL-08-040140 -+ stigid@almalinux8: RHEL-08-040140 +- stigid@rhel8: RHEL-08-040141 ++ stigid@almalinux8: RHEL-08-040141 ocil_clause: 'the service is not enabled' -diff --git a/linux_os/guide/services/usbguard/usbguard_allow_hid/bash/shared.sh b/linux_os/guide/services/usbguard/usbguard_allow_hid/bash/shared.sh -index 08045d58..16c8f6b5 100644 ---- a/linux_os/guide/services/usbguard/usbguard_allow_hid/bash/shared.sh -+++ b/linux_os/guide/services/usbguard/usbguard_allow_hid/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 - - # path of file with Usbguard rules - rulesfile="/etc/usbguard/rules.conf" diff --git a/linux_os/guide/services/usbguard/usbguard_allow_hid/rule.yml b/linux_os/guide/services/usbguard/usbguard_allow_hid/rule.yml -index 2567ba5e..ad81abe0 100644 +index 35039ee7..d04b9090 100644 --- a/linux_os/guide/services/usbguard/usbguard_allow_hid/rule.yml +++ b/linux_os/guide/services/usbguard/usbguard_allow_hid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Authorize Human Interface Devices in USBGuard daemon' -diff --git a/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/bash/shared.sh b/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/bash/shared.sh -index a2e334c8..884ba0c6 100644 ---- a/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/bash/shared.sh -+++ b/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/bash/shared.sh +diff --git a/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/kubernetes/shared.yml b/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/kubernetes/shared.yml +index 03825010..b072e299 100644 +--- a/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/kubernetes/shared.yml ++++ b/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/kubernetes/shared.yml @@ -1,5 +1,5 @@ - #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 - - - echo "allow with-interface match-all { 03:*:* 09:00:* }" >> /etc/usbguard/rules.conf + --- +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos + {{% macro usbguard_hid_and_hub_config_source() %}} + allow with-interface match-all { 03:*:* 09:00:* } + {{%- endmacro -%}} diff --git a/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/rule.yml b/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/rule.yml -index fdc6c19a..c0da2f53 100644 +index d16d0092..af44407c 100644 --- a/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/rule.yml +++ b/linux_os/guide/services/usbguard/usbguard_allow_hid_and_hub/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Authorize Human Interface Devices and USB hubs in USBGuard daemon' -diff --git a/linux_os/guide/services/usbguard/usbguard_allow_hub/bash/shared.sh b/linux_os/guide/services/usbguard/usbguard_allow_hub/bash/shared.sh -index 47d58963..19907534 100644 ---- a/linux_os/guide/services/usbguard/usbguard_allow_hub/bash/shared.sh -+++ b/linux_os/guide/services/usbguard/usbguard_allow_hub/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 - - - echo "allow with-interface match-all { 09:00:* }" >> /etc/usbguard/rules.conf diff --git a/linux_os/guide/services/usbguard/usbguard_allow_hub/rule.yml b/linux_os/guide/services/usbguard/usbguard_allow_hub/rule.yml -index 17a8a8d5..054b9f5f 100644 +index d0e11ad2..31033934 100644 --- a/linux_os/guide/services/usbguard/usbguard_allow_hub/rule.yml +++ b/linux_os/guide/services/usbguard/usbguard_allow_hub/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Authorize USB hubs in USBGuard daemon' +diff --git a/linux_os/guide/services/usbguard/usbguard_generate_policy/ansible/shared.yml b/linux_os/guide/services/usbguard/usbguard_generate_policy/ansible/shared.yml +index 3ff0d386..ee971e2e 100644 +--- a/linux_os/guide/services/usbguard/usbguard_generate_policy/ansible/shared.yml ++++ b/linux_os/guide/services/usbguard/usbguard_generate_policy/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel ++# platform = multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/services/usbguard/usbguard_generate_policy/bash/shared.sh b/linux_os/guide/services/usbguard/usbguard_generate_policy/bash/shared.sh +index d3fe0650..794f1be9 100644 +--- a/linux_os/guide/services/usbguard/usbguard_generate_policy/bash/shared.sh ++++ b/linux_os/guide/services/usbguard/usbguard_generate_policy/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel ++# platform = multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/services/usbguard/usbguard_generate_policy/rule.yml b/linux_os/guide/services/usbguard/usbguard_generate_policy/rule.yml +index ca42efc0..c092e7cb 100644 +--- a/linux_os/guide/services/usbguard/usbguard_generate_policy/rule.yml ++++ b/linux_os/guide/services/usbguard/usbguard_generate_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8 ++prodtype: rhel8,almalinux8 + + title: 'Generate USBGuard Policy' + +@@ -26,7 +26,7 @@ references: + nist: CM-8(3)(a),IA-3 + ospp: FMT_SMF_EXT.1 + srg: SRG-OS-000378-GPOS-00163 +- stigid@rhel8: RHEL-08-040140 ++ stigid@almalinux8: RHEL-08-040140 + + ocil_clause: '/etc/usbguard/rules.conf does not exist or is empty' + diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml -index 789b8464..d9286069 100644 +index 6e739d21..d8bd59f2 100644 --- a/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml +++ b/linux_os/guide/services/xwindows/disabling_xwindows/package_xorg-x11-server-common_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Remove the X Windows Package Group' @@ -10962,44 +4580,77 @@ index 789b8464..d9286069 100644 <pre>$ sudo {{{ pkg_manager }}} groupremove base-x</pre> {{%- else %}} <pre>$ sudo {{{ pkg_manager }}} groupremove "X Window System"</pre> -@@ -40,7 +40,7 @@ references: - iso27001-2013: A.11.2.6,A.13.1.1,A.13.2.1,A.14.1.3,A.6.2.1,A.6.2.2 - cis-csc: 12,15,8 - cis@sle15: 2.2.2 -- stigid@rhel8: RHEL-08-040320 -+ stigid@almalinux8: RHEL-08-040320 - - ocil_clause: 'the X Windows package group or xorg-x11-server-common has not be removed' - -diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml -index 72a3c541..4780ae38 100644 ---- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml -+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml +diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml +index 5b3afb32..49d06563 100644 +--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml ++++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_sle,multi_platform_rhv,multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 -+# platform = multi_platform_sle,multi_platform_rhv,multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol # reboot = true # strategy = restrict # complexity = low -diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/bash/shared.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/bash/shared.sh -index 289a3848..d9ecbd54 100644 ---- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/bash/shared.sh -+++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/bash/shared.sh +diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml +index 935766db..7987f10f 100644 +--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml ++++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 + + title: 'Disable graphical user interface' + +@@ -47,7 +47,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040730 + stigid@rhel7: RHEL-07-040730 +- stigid@rhel8: RHEL-08-040320 ++ stigid@almalinux8: RHEL-08-040320 + + ocil_clause: 'xorg related packages are not removed and run level is not correctly configured' + +diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh +index 14f1a97b..fe071168 100644 +--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh ++++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_correct_target.fail.sh @@ -1,4 +1,4 @@ --# platform = multi_platform_sle,multi_platform_rhv,multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 -+# platform = multi_platform_sle,multi_platform_rhv,multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland + +diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh +index c678ef71..5b835c55 100644 +--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh ++++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_remove_packages/tests/rhel8_packages_installed_wrong_target.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # packages = xorg-x11-server-Xorg,xorg-x11-server-common,xorg-x11-server-utils,xorg-x11-server-Xwayland + + systemctl set-default graphical.target +diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml +index 7c3ef557..fbf7bcec 100644 +--- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml ++++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhv,multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol ++# platform = multi_platform_sle,multi_platform_rhv,multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol # reboot = true # strategy = restrict # complexity = low diff --git a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml -index a1d60c3b..5132de2c 100644 +index de0e359a..1afa0d74 100644 --- a/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml +++ b/linux_os/guide/services/xwindows/disabling_xwindows/xwindows_runlevel_target/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle12,sle15,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle12,sle15,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15 title: 'Disable X Windows Startup By Setting Default Target' @@ -11044,7 +4695,7 @@ index 408409b9..3cc5a7b9 100644 ln -sf /lib/systemd/system/graphical.target /etc/systemd/system/default.target diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml -index ff6b6eab..d0b558b6 100644 +index 4f6d64fd..3c980eea 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -11064,33 +4715,33 @@ index f6d5f160..3f901f27 100644 {{{ bash_instantiate_variables("login_banner_text") }}} diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml -index 5e008467..3426177c 100644 +index 185b8246..e08e5d5f 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_issue/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Modify the System Login Banner' -@@ -71,7 +71,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 +@@ -106,7 +106,7 @@ references: + srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007 + stigid@ol7: OL07-00-010050 + stigid@rhel7: RHEL-07-010050 - stigid@rhel8: RHEL-08-010060 + stigid@almalinux8: RHEL-08-010060 - - ocil_clause: 'it does not display the required banner' - + stigid@sle12: SLES-12-010030 + stigid@sle15: SLES-15-010020 + vmmsrg: SRG-OS-000023-VMM-000060,SRG-OS-000024-VMM-000070 diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml -index e82619db..df040f30 100644 +index 2c645889..ab68929b 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle -+# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # reboot = false # strategy = unknown # complexity = low @@ -11105,164 +4756,163 @@ index 4a3844a7..bf49e397 100644 {{{ bash_instantiate_variables("login_banner_text") }}} diff --git a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/rule.yml b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/rule.yml -index 255c438c..7be75325 100644 +index bb74c68d..ad43307f 100644 --- a/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/banner_etc_motd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Modify the System Message of the Day Banner' diff --git a/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_issue/rule.yml b/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_issue/rule.yml -index 00fc602b..97e35c95 100644 +index 01c1244d..0543798a 100644 --- a/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_issue/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_issue/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhv4,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhv4,ubuntu2004,wrlinux1019 title: 'Verify Group Ownership of System Login Banner' diff --git a/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_motd/rule.yml b/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_motd/rule.yml -index a073bcbf..1c5fee0f 100644 +index 983c0b60..f8a6cee2 100644 --- a/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_motd/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/file_groupowner_etc_motd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,ubuntu2004,wrlinux1019 title: 'Verify Group Ownership of Message of the Day Banner' diff --git a/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_issue/rule.yml b/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_issue/rule.yml -index 79ec35d9..f19283b7 100644 +index d73943a2..4095965a 100644 --- a/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_issue/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_issue/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhv4,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhv4,ubuntu2004,wrlinux1019 title: 'Verify ownership of System Login Banner' diff --git a/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_motd/rule.yml b/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_motd/rule.yml -index 8d81ea7c..fa623eb5 100644 +index 9a05169c..e703f8e1 100644 --- a/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_motd/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/file_owner_etc_motd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,ubuntu2004,wrlinux1019 title: 'Verify ownership of Message of the Day Banner' diff --git a/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_issue/rule.yml b/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_issue/rule.yml -index e425f8f6..eeaa7c65 100644 +index cc7ab4b5..0e82ddd2 100644 --- a/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_issue/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_issue/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Verify permissions on System Login Banner' diff --git a/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_motd/rule.yml b/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_motd/rule.yml -index d6141d2f..ac8961d0 100644 +index ee01ebf3..92b16e2a 100644 --- a/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_motd/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/file_permissions_etc_motd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Verify permissions on Message of the Day Banner' diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml -index 4a0da070..d291de86 100644 +index 5814a30b..aa4aa4c5 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_sle # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh -index 1f6c229d..f7c77d04 100644 ---- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol - - - {{{ bash_dconf_settings("org/gnome/login-screen", "banner-message-enable", "true", "gdm.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml -index 47c4edad..b1ab29ef 100644 +index b6ba3edc..a4d11762 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15,ubuntu2004 title: 'Enable GNOME3 Login Warning Banner' +@@ -54,7 +54,7 @@ references: + srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007,SRG-OS-000228-GPOS-00088 + stigid@ol7: OL07-00-010030 + stigid@rhel7: RHEL-07-010030 +- stigid@rhel8: RHEL-08-010049 ++ stigid@almalinux8: RHEL-08-010049 + stigid@sle12: SLES-12-010040 + stigid@sle15: SLES-15-010080 + stigid@ubuntu2004: UBTU-20-010002 diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml -index 7862ac20..88092b1b 100644 +index 86aff54f..b295782b 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_sle # reboot = false # strategy = unknown # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh -index 0f60c14e..f6636dce 100644 +index d15a814e..f914cdf0 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_sle . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("login_banner_text") }}} diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/rule.yml b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/rule.yml -index 135f15e1..12c549ab 100644 +index 2a58d096..10e69440 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/rule.yml +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15,ubuntu2004 title: 'Set the GNOME3 Login Warning Banner Text' -@@ -47,7 +47,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 +@@ -52,7 +52,7 @@ references: + srg: SRG-OS-000023-GPOS-00006,SRG-OS-000024-GPOS-00007,SRG-OS-000228-GPOS-00088 + stigid@ol7: OL07-00-010040 + stigid@rhel7: RHEL-07-010040 - stigid@rhel8: RHEL-08-010050 + stigid@almalinux8: RHEL-08-010050 - - ocil_clause: 'it does not' - + stigid@sle12: SLES-12-010050 + stigid@sle15: SLES-15-010090 + stigid@ubuntu2004: UBTU-20-010003 diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/correct_value_stig.pass.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/correct_value_stig.pass.sh -index dca4b8e9..a58d47b5 100644 +index 4f31757c..0ed60e11 100644 --- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/correct_value_stig.pass.sh +++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/correct_value_stig.pass.sh @@ -1,5 +1,5 @@ @@ -11270,93 +4920,278 @@ index dca4b8e9..a58d47b5 100644 -# platform = Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 +# platform = Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8,AlmaLinux 8 # profiles = xccdf_org.ssgproject.content_profile_stig + # packages = dconf,gdm - source $SHARED/dconf_test_functions.sh -diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/missing_value_stig.fail.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/missing_value_stig.fail.sh -index 96386811..c445de50 100644 ---- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/missing_value_stig.fail.sh -+++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/missing_value_stig.fail.sh -@@ -1,5 +1,5 @@ - #!/bin/bash --# platform = Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8,AlmaLinux 8 - # profiles = xccdf_org.ssgproject.content_profile_stig +diff --git a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/ansible/shared.yml +index 7184cb2f..7da232a4 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/ansible/shared.yml ++++ b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/ansible/shared.yml +@@ -4,7 +4,7 @@ + {{% set pam_lastlog_filename = "postlogin" %}} + {{% endif %}} - source $SHARED/dconf_test_functions.sh -diff --git a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/wrong_value_stig.fail.sh b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/wrong_value_stig.fail.sh -index cd65f885..060fea03 100644 ---- a/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/wrong_value_stig.fail.sh -+++ b/linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/tests/wrong_value_stig.fail.sh -@@ -1,5 +1,5 @@ - #!/bin/bash --# platform = Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8,AlmaLinux 8 - # profiles = xccdf_org.ssgproject.content_profile_stig - - source $SHARED/dconf_test_functions.sh +-# platform = multi_platform_sle,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux ++# platform = multi_platform_sle,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux + # reboot = false + # strategy = configure + # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/bash/shared.sh -index 1190adf8..e0244f49 100644 +index f39293d6..41cd9809 100644 --- a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux +@@ -3,7 +3,7 @@ + {{% else %}} + {{% set pam_lastlog_path = "/etc/pam.d/postlogin" %}} + {{% endif %}} +-# platform = multi_platform_sle,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux ++# platform = multi_platform_sle,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux + . /usr/share/scap-security-guide/remediation_functions - if grep -q "^session.*pam_lastlog.so" /etc/pam.d/postlogin; then - sed -i --follow-symlinks "/pam_lastlog.so/d" /etc/pam.d/postlogin + ensure_pam_module_options '{{{ pam_lastlog_path }}}' 'session' 'required' 'pam_lastlog.so' 'showfailed' "" "" diff --git a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/rule.yml b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/rule.yml -index a6eefa9c..1b9d041c 100644 +index e8403af7..32ea4dff 100644 --- a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/rule.yml -@@ -38,7 +38,7 @@ references: - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 - ism: 0582,0584,05885,0586,0846,0957 +@@ -47,7 +47,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040530 + stigid@rhel7: RHEL-07-040530 - stigid@rhel8: RHEL-08-020340 + stigid@almalinux8: RHEL-08-020340 + stigid@sle12: SLES-12-010390 + stigid@sle15: SLES-15-020080 + stigid@ubuntu2004: UBTU-20-010453 +diff --git a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/correct_value.pass.sh +index 73500d38..90c6989b 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/correct_value.pass.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/correct_value.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_ol - ocil_clause: 'that is not the case' + rm -f /etc/pam.d/postlogin + echo "session required pam_lastlog.so showfailed" >> /etc/pam.d/postlogin +diff --git a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/default_config.fail.sh b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/default_config.fail.sh +index 0a732124..87afb9f2 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/default_config.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/default_config.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_ol + rm -f /etc/pam.d/postlogin + +diff --git a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value.fail.sh +index 319fdefa..49a5a712 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_ol + + rm -f /etc/pam.d/postlogin + # pamd ansible module has a bug that if there is only one line in the file it raises an Out of Index exception +diff --git a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value_silent.fail.sh b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value_silent.fail.sh +index 8a1791e9..7b618636 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value_silent.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/display_login_attempts/tests/wrong_value_silent.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_ol + + rm -f /etc/pam.d/postlogin + # pamd ansible module has a bug that if there is only one line in the file it raises an Out of Index exception diff --git a/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/ansible/shared.yml -index 59a251e0..1d921641 100644 +index bd7ad0c9..b11a08e0 100644 --- a/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol # reboot = false # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/bash/shared.sh -index 8942cb0b..a87fa4fb 100644 +index b1d8a452..ed798c23 100644 --- a/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol if ! grep -Eq '^\s*session\s+required\s+pam_namespace.so\s*$' '/etc/pam.d/login' ; then echo "session required pam_namespace.so" >> "/etc/pam.d/login" fi -\ No newline at end of file diff --git a/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/rule.yml b/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/rule.yml -index 8e713fe2..886d6037 100644 +index c21c1cb8..e663f820 100644 --- a/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/enable_pam_namespace/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 title: Set Up a Private Namespace in PAM Configuration +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/ansible/shared.yml +index 8b004c12..a2f505b5 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/ansible/shared.yml ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/bash/shared.sh +index 2d2b50f1..46bc9fde 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/bash/shared.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv + . /usr/share/scap-security-guide/remediation_functions + {{{ bash_instantiate_variables("var_password_pam_remember", "var_password_pam_remember_control_flag") }}} + +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml +index 62b6f55e..0fb9273f 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 + + title: 'Limit Password Reuse: password-auth' + +@@ -41,7 +41,7 @@ references: + srg: SRG-OS-000077-GPOS-00045 + stigid@ol7: OL07-00-010270 + stigid@rhel7: RHEL-07-010270 +- stigid@rhel8: RHEL-08-020220 ++ stigid@almalinux8: RHEL-08-020220 + vmmsrg: SRG-OS-000077-VMM-000440 + + ocil_clause: |- +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_argument_missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_argument_missing.fail.sh +index 773e68ea..b462705c 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_argument_missing.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_argument_missing.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux + # variables = var_password_pam_remember_control_flag=required + # packages = pam + +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_correct_value.pass.sh +index 89f88502..a9d6d878 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_correct_value.pass.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_correct_value.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux + # variables = var_password_pam_remember_control_flag=required + # packages = pam + +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_wrong_value.fail.sh +index 148a4519..93a4e361 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_wrong_value.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_password_auth/tests/rhel8_wrong_value.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux + # variables = var_password_pam_remember_control_flag=required + # packages = pam + +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/ansible/shared.yml +index 57394231..610fd9e6 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/ansible/shared.yml ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/bash/shared.sh +index 2ccc2024..15561950 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/bash/shared.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv + . /usr/share/scap-security-guide/remediation_functions + {{{ bash_instantiate_variables("var_password_pam_remember", "var_password_pam_remember_control_flag") }}} + +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/rule.yml +index 8cc56eb8..c7a1d0da 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 + + title: 'Limit Password Reuse: system-auth' + +@@ -41,7 +41,7 @@ references: + srg: SRG-OS-000077-GPOS-00045 + stigid@ol7: OL07-00-010270 + stigid@rhel7: RHEL-07-010270 +- stigid@rhel8: RHEL-08-020220 ++ stigid@almalinux8: RHEL-08-020220 + vmmsrg: SRG-OS-000077-VMM-000440 + + ocil_clause: |- +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_argument_missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_argument_missing.fail.sh +index e8f36c8d..0d23f6c6 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_argument_missing.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_argument_missing.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux + # variables = var_password_pam_remember_control_flag=required + # packages = pam + +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_correct_value.pass.sh +index 6aee4cd7..1c489449 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_correct_value.pass.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_correct_value.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux + # variables = var_password_pam_remember_control_flag=required + # packages = pam + +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_wrong_value.fail.sh +index 2bf4eebf..bb6d67c1 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_wrong_value.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_remember_system_auth/tests/rhel8_wrong_value.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux + # variables = var_password_pam_remember_control_flag=required + # packages = pam + diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/ansible/shared.yml -index 905acc32..d2969e41 100644 +index dcaff8a5..abdaed66 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle # reboot = false # strategy = configure # complexity = low @@ -11371,26 +5206,50 @@ index e0dabe67..543d2e2c 100644 {{{ bash_instantiate_variables("var_password_pam_unix_remember") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml -index 78247557..287f84ba 100644 +index a2b66fc4..5fd4bcd2 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Limit Password Reuse' -@@ -46,7 +46,7 @@ references: - cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 -- stigid@rhel8: RHEL-08-020220 -+ stigid@almalinux8: RHEL-08-020220 +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/argument_missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/argument_missing.fail.sh +index c8993ef2..ade70b89 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/argument_missing.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/argument_missing.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux ++# platform = multi_platform_rhel,multi_platform_almalinux,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux - ocil_clause: 'the value of remember is not set equal to or greater than the expected setting' + for auth_file in system-auth password-auth + do +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_correct_value.pass.sh +index 3f37257c..518883a6 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_correct_value.pass.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_correct_value.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + remember_cnt=5 + for auth_file in system-auth password-auth +diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_wrong_value.fail.sh +index 86ec2380..d349b1a3 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_wrong_value.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_unix_remember/tests/rhel8_wrong_value.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + + remember_cnt=3 + for auth_file in system-auth password-auth diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/ansible/shared.yml index 0622ae76..8359d1fa 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/ansible/shared.yml @@ -11412,26 +5271,26 @@ index 3157d341..9af8913c 100644 {{{ bash_instantiate_variables("var_accounts_passwords_pam_faillock_deny") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml -index 85a0ba18..1dd6f0cc 100644 +index 141f4c5b..1baa8f5e 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Set Deny For Failed Password Attempts' -@@ -47,7 +47,7 @@ references: - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -49,7 +49,7 @@ references: + srg: SRG-OS-000329-GPOS-00128,SRG-OS-000021-GPOS-00005 + stigid@ol7: OL07-00-010320 + stigid@rhel7: RHEL-07-010320 - stigid@rhel8: RHEL-08-020010 + stigid@almalinux8: RHEL-08-020010 + vmmsrg: SRG-OS-000021-VMM-000050 ocil_clause: 'that is not the case' - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/ansible/shared.yml index d81d8d87..28148b44 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/ansible/shared.yml @@ -11453,35 +5312,35 @@ index d43c33d2..57b4374d 100644 AUTH_FILES[0]="/etc/pam.d/system-auth" AUTH_FILES[1]="/etc/pam.d/password-auth" diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml -index fb7a2d37..627052fd 100644 +index 25dfb328..90ec1676 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny_root/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Configure the root Account for Failed Password Attempts' -@@ -44,7 +44,7 @@ references: - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000329-GPOS-00128,SRG-OS-000021-GPOS-00005 + stigid@ol7: OL07-00-010330 + stigid@rhel7: RHEL-07-010330 - stigid@rhel8: RHEL-08-020022 + stigid@almalinux8: RHEL-08-020022 ocil_clause: 'that is not the case' diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_enforce_local/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_enforce_local/rule.yml -index 17c9932d..54394e8c 100644 +index 5aec848f..cadf5993 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_enforce_local/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_enforce_local/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel8 -+prodtype: fedora,rhel8,almalinux8 +-prodtype: fedora,rhel8,rhel9 ++prodtype: fedora,rhel8,almalinux8,rhel9 title: 'Enforce pam_faillock for Local Accounts Only' @@ -11506,26 +5365,26 @@ index 87310288..8b7a7bdd 100644 # include our remediation functions library . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml -index 6bc0f02a..71ee1fcf 100644 +index 1df46bd4..601cec5d 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Set Interval For Counting Failed Password Attempts' -@@ -53,7 +53,7 @@ references: - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -54,7 +54,7 @@ references: + srg: SRG-OS-000329-GPOS-00128,SRG-OS-000021-GPOS-00005 + stigid@ol7: OL07-00-010320 + stigid@rhel7: RHEL-07-010320 - stigid@rhel8: RHEL-08-020012 + stigid@almalinux8: RHEL-08-020012 + vmmsrg: SRG-OS-000021-VMM-000050 ocil_clause: 'fail_interval is less than the required value' - diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml index db44ce4f..329103e5 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/ansible/shared.yml @@ -11547,220 +5406,241 @@ index 7e36721d..4561783d 100644 {{{ bash_instantiate_variables("var_accounts_passwords_pam_faillock_unlock_time") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml -index ead8f697..02fa9d9d 100644 +index ea8c8fea..9ca6071b 100644 --- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Set Lockout Time for Failed Password Attempts' -@@ -50,7 +50,7 @@ references: - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -52,7 +52,7 @@ references: + srg: SRG-OS-000329-GPOS-00128,SRG-OS-000021-GPOS-00005 + stigid@ol7: OL07-00-010320 + stigid@rhel7: RHEL-07-010320 - stigid@rhel8: RHEL-08-020014 + stigid@almalinux8: RHEL-08-020014 + vmmsrg: SRG-OS-000329-VMM-001180 ocil_clause: 'unlock_time is less than the expected value' - diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml -index 11040cfa..2143ade7 100644 +index 8dad49f0..3ff43ace 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dcredit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Minimum Digit Characters' -@@ -46,7 +46,7 @@ references: - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000071-GPOS-00039 + stigid@ol7: OL07-00-010140 + stigid@rhel7: RHEL-07-010140 - stigid@rhel8: RHEL-08-020130 + stigid@almalinux8: RHEL-08-020130 + stigid@ubuntu2004: UBTU-20-010052 + vmmsrg: SRG-OS-000071-VMM-000380 - ocil_clause: 'dcredit is not found or not equal to or less than the required value' +diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml +index d0d4b8c5..eca44d53 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_dictcheck/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true +-prodtype: fedora,rhel8,ubuntu2004 ++prodtype: fedora,rhel8,almalinux8,ubuntu2004 + + title: 'Ensure PAM Enforces Password Requirements - Prevent the Use of Dictionary Words' + +@@ -28,7 +28,7 @@ references: + disa: CCI-000366 + nist: IA-5(c),IA-5(1)(a),CM-6(a),IA-5(4) + srg: SRG-OS-000480-GPOS-00225 +- stigid@rhel8: RHEL-08-020300 ++ stigid@almalinux8: RHEL-08-020300 + stigid@ubuntu2004: UBTU-20-010056 + + ocil_clause: 'dictcheck is not found or not equal to the required value' diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_difok/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_difok/rule.yml -index d659f480..a36c0004 100644 +index d601c53e..8fbefbb6 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_difok/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_difok/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Minimum Different Characters' @@ -47,7 +47,7 @@ references: - cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 + srg: SRG-OS-000072-GPOS-00040 + stigid@ol7: OL07-00-010160 + stigid@rhel7: RHEL-07-010160 - stigid@rhel8: RHEL-08-020170 + stigid@almalinux8: RHEL-08-020170 - - ocil_clause: 'difok is not found or not equal to or greater than the required value' + stigid@ubuntu2004: UBTU-20-010053 + vmmsrg: SRG-OS-000072-VMM-000390 diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml -index ffbb0147..cd7a9d09 100644 +index ae762335..9fb6286e 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_local/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel8 -+prodtype: fedora,rhel8,almalinux8 +-prodtype: fedora,rhel8,rhel9 ++prodtype: fedora,rhel8,almalinux8,rhel9 title: 'Ensure PAM Enforces Password Requirements - Enforce for Local Accounts Only' diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml -index a3f02884..4f7083ea 100644 +index 33dcaf08..7fe6101a 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_enforce_root/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel8 -+prodtype: fedora,rhel8,almalinux8 +-prodtype: fedora,rhel8,rhel9 ++prodtype: fedora,rhel8,almalinux8,rhel9 title: 'Ensure PAM Enforces Password Requirements - Enforce for root User' diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml -index 08635437..8dc2865e 100644 +index 0f00a166..cb287eb0 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_lcredit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Minimum Lowercase Characters' -@@ -45,7 +45,7 @@ references: - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000070-GPOS-00038 + stigid@ol7: OL07-00-010130 + stigid@rhel7: RHEL-07-010130 - stigid@rhel8: RHEL-08-020120 + stigid@almalinux8: RHEL-08-020120 - - ocil_clause: 'lcredit is not found or not less than or equal to the required value' + stigid@ubuntu2004: UBTU-20-010051 + vmmsrg: SRG-OS-000070-VMM-000370 diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml -index 5bac335e..6e282c17 100644 +index 1d53a714..e537640a 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxclassrepeat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Maximum Consecutive Repeating Characters from Same Character Class' -@@ -38,7 +38,7 @@ references: - cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 +@@ -39,7 +39,7 @@ references: + srg: SRG-OS-000072-GPOS-00040 + stigid@ol7: OL07-00-010190 + stigid@rhel7: RHEL-07-010190 - stigid@rhel8: RHEL-08-020140 + stigid@almalinux8: RHEL-08-020140 ocil_clause: 'that is not the case' diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxrepeat/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxrepeat/rule.yml -index 42d5584a..250dd698 100644 +index 9855b104..05b877ac 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxrepeat/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_maxrepeat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Set Password Maximum Consecutive Repeating Characters' -@@ -40,7 +40,7 @@ references: - cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 +@@ -41,7 +41,7 @@ references: + srg: SRG-OS-000072-GPOS-00040 + stigid@ol7: OL07-00-010180 + stigid@rhel7: RHEL-07-010180 - stigid@rhel8: RHEL-08-020150 + stigid@almalinux8: RHEL-08-020150 ocil_clause: 'maxrepeat is not found or not greater than or equal to the required value' diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml -index 3e71d909..1526d077 100644 +index 35b4e357..9a719b34 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minclass/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Minimum Different Categories' -@@ -53,7 +53,7 @@ references: - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -57,7 +57,7 @@ references: + srg: SRG-OS-000072-GPOS-00040 + stigid@ol7: OL07-00-010170 + stigid@rhel7: RHEL-07-010170 - stigid@rhel8: RHEL-08-020160 + stigid@almalinux8: RHEL-08-020160 ocil_clause: 'minclass is not found or not set equal to or greater than the required value' diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml -index a79a03f3..cbc5fd7d 100644 +index db404151..6644947c 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_minlen/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Minimum Length' -@@ -44,7 +44,7 @@ references: - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -47,7 +47,7 @@ references: + srg: SRG-OS-000078-GPOS-00046 + stigid@ol7: OL07-00-010280 + stigid@rhel7: RHEL-07-010280 - stigid@rhel8: RHEL-08-020230 + stigid@almalinux8: RHEL-08-020230 - - ocil_clause: 'minlen is not found, or not equal to or greater than the required value' + stigid@ubuntu2004: UBTU-20-010054 + vmmsrg: SRG-OS-000072-VMM-000390,SRG-OS-000078-VMM-000450 diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml -index dd05085f..cbb5ed6e 100644 +index 34614935..241f3bc3 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ocredit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Minimum Special Characters' -@@ -46,7 +46,7 @@ references: - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -49,7 +49,7 @@ references: + srg: SRG-OS-000266-GPOS-00101 + stigid@ol7: OL07-00-010150 + stigid@rhel7: RHEL-07-010150 - stigid@rhel8: RHEL-08-020280 + stigid@almalinux8: RHEL-08-020280 - - ocil_clause: 'ocredit is not found or not equal to or less than the required value' + stigid@ubuntu2004: UBTU-20-010055 + vmmsrg: SRG-OS-000266-VMM-000940 diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/ansible/shared.yml -index af3010be..47ab5f6a 100644 +index d4017ce6..d0e015ab 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -11769,57 +5649,80 @@ index af3010be..47ab5f6a 100644 # reboot = false # strategy = configure # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/bash/shared.sh -index f69152b2..83cf601f 100644 ---- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux - . /usr/share/scap-security-guide/remediation_functions - {{{ bash_instantiate_variables("var_password_pam_retry") }}} - diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml -index 90f74b2d..b2a90325 100644 +index 36ef711c..ae7be267 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session' -@@ -38,7 +38,7 @@ references: - cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,11,12,15,16,3,5,9 +@@ -43,7 +43,7 @@ references: + srg: SRG-OS-000480-GPOS-00225,SRG-OS-000069-GPOS-00037 + stigid@ol7: OL07-00-010119 + stigid@rhel7: RHEL-07-010119 - stigid@rhel8: RHEL-08-020100 + stigid@almalinux8: RHEL-08-020100 + stigid@ubuntu2004: UBTU-20-010057 ocil_clause: 'it is not the required value' +diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_argument_missing.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_argument_missing.fail.sh +index fb3acb2b..20f3d945 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_argument_missing.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_argument_missing.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + for auth_file in system-auth password-auth + do +diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_correct_value.pass.sh +index d6f07df7..5c4b5569 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_correct_value.pass.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_correct_value.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + + retry_cnt=3 + for auth_file in system-auth password-auth +diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_wrong_value.fail.sh b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_wrong_value.fail.sh +index f4988fa1..d94dfaaf 100644 +--- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_wrong_value.fail.sh ++++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_retry/tests/rhel8_wrong_value.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + + retry_cnt=7 + for auth_file in system-auth password-auth diff --git a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml -index 5a656a42..ff396279 100644 +index 2a3bb9e1..18b8b205 100644 --- a/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/password_quality/password_quality_pwquality/accounts_password_pam_ucredit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Ensure PAM Enforces Password Requirements - Minimum Uppercase Characters' -@@ -43,7 +43,7 @@ references: - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -45,7 +45,7 @@ references: + srg: SRG-OS-000069-GPOS-00037 + stigid@ol7: OL07-00-010120 + stigid@rhel7: RHEL-07-010120 - stigid@rhel8: RHEL-08-020110 + stigid@almalinux8: RHEL-08-020110 - - ocil_clause: 'ucredit is not found or not set less than or equal to the required value' + stigid@ubuntu2004: UBTU-20-010050 + vmmsrg: SRG-OS-000069-VMM-000360 diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/ansible/shared.yml index f0b884d9..59e66c07 100644 @@ -11842,14 +5745,14 @@ index f929a6e9..9145de3b 100644 LIBUSER_CONF="/etc/libuser.conf" CRYPT_STYLE_REGEX='[[:space:]]*\[defaults](.*(\n)+)+?[[:space:]]*crypt_style[[:space:]]*' diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/rule.yml -index 57c63cb1..28039795 100644 +index f3b9c7ba..b5173e62 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_libuserconf/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Set Password Hashing Algorithm in /etc/libuser.conf' @@ -11874,26 +5777,26 @@ index 377570ae..c6ed161b 100644 {{{ bash_instantiate_variables("var_password_hashing_algorithm") }}} diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/rule.yml -index bbfcd7fc..26bdc3a7 100644 +index 7183cf0e..e4cd63f5 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Set Password Hashing Algorithm in /etc/login.defs' @@ -42,7 +42,7 @@ references: - cis-csc: 1,12,15,16,5 - anssi: BP28(R32) - ism: 0418,1055,1402 + srg: SRG-OS-000073-GPOS-00041 + stigid@ol7: OL07-00-010210 + stigid@rhel7: RHEL-07-010210 - stigid@rhel8: RHEL-08-010110 + stigid@almalinux8: RHEL-08-010110 - - ocil_clause: 'it does not' - + stigid@sle12: SLES-12-010210 + stigid@sle15: SLES-15-010260 + stigid@ubuntu2004: UBTU-20-010404 diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh index 02af406f..67248912 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/bash/shared.sh @@ -11905,24 +5808,33 @@ index 02af406f..67248912 100644 AUTH_FILES[0]="/etc/pam.d/system-auth" AUTH_FILES[1]="/etc/pam.d/password-auth" diff --git a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml -index 40f5a16f..3a31f64e 100644 +index 24ab30d7..cae46763 100644 --- a/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml +++ b/linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: "Set PAM's Password Hashing Algorithm" +@@ -69,7 +69,7 @@ references: + srg: SRG-OS-000073-GPOS-00041 + stigid@ol7: OL07-00-010200 + stigid@rhel7: RHEL-07-010200 +- stigid@rhel8: RHEL-08-010160 ++ stigid@almalinux8: RHEL-08-010160 + stigid@sle12: SLES-12-010230 + stigid@sle15: SLES-15-020170 + vmmsrg: SRG-OS-000480-VMM-002000 diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml -index 749cb4a7..0e762bd3 100644 +index f6888e51..cae502b8 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_sle # reboot = false # strategy = disable # complexity = low @@ -11937,35 +5849,36 @@ index 7d4faedf..8e068a06 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/kubernetes/shared.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/kubernetes/shared.yml -index 6514bf41..3c07c425 100644 +index 3045574e..7ce6bb46 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/kubernetes/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml -index 7192666f..c9130cc7 100644 +index 139d230b..1c712f97 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_burstaction/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Disable Ctrl-Alt-Del Burst Action' -@@ -37,7 +37,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -70,7 +70,7 @@ references: + nist-csf: PR.AC-4,PR.DS-5 + nist@sle15: CM-6(b),CM-6.1(iv) + srg: SRG-OS-000324-GPOS-00125,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040172 + stigid@almalinux8: RHEL-08-040172 - - ocil_clause: 'the system is configured to reboot when Ctrl-Alt-Del is pressed more than 7 times in 2 seconds.' + stigid@sle15: SLES-15-040062 + stigid@ubuntu2004: UBTU-20-010460 diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/ansible/shared.yml index 8ea1de86..a4edf584 100644 @@ -11978,51 +5891,60 @@ index 8ea1de86..a4edf584 100644 # strategy = disable # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/bash/shared.sh -index 2b70d22d..3ee92050 100644 +index 94767ad5..662dc0dd 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/bash/shared.sh -@@ -1,8 +1,7 @@ +@@ -1,6 +1,6 @@ -# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux +# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux {{%- if init_system == "systemd" -%}} -{{% if product in ["rhel7", "rhel8"] %}} --# The process to disable ctrl+alt+del has changed in RHEL7. --# Reference: https://access.redhat.com/solutions/1123873 +{{% if product in ["rhel7", "rhel8", "almalinux8"] %}} -+# The process to disable ctrl+alt+del has changed in RHEL7. + # The process to disable ctrl+alt+del has changed in RHEL7. + # Reference: https://access.redhat.com/solutions/1123873 {{% endif %}} - systemctl mask --now ctrl-alt-del.target - {{%- else -%}} +diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/kubernetes/shared.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/kubernetes/shared.yml +index 517c83c6..041e9a29 100644 +--- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/kubernetes/shared.yml ++++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/rule.yml b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/rule.yml -index 6066c939..bb3114c2 100644 +index 7c82f4a3..83c162a9 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Ctrl-Alt-Del Reboot Activation' -@@ -47,7 +47,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -75,7 +75,7 @@ references: + srg: SRG-OS-000324-GPOS-00125,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020230 + stigid@rhel7: RHEL-07-020230 - stigid@rhel8: RHEL-08-040170 + stigid@almalinux8: RHEL-08-040170 - - ocil_clause: 'the system is configured to reboot when Ctrl-Alt-Del is pressed' - + stigid@sle12: SLES-12-010610 + stigid@sle15: SLES-15-040060 + stigid@ubuntu2004: UBTU-20-010460 diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh -index cc333ea2..2799c151 100644 +index b56b59b2..0e0b89ca 100644 --- a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh +++ b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/masked.pass.sh -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ #!/bin/bash -# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora +# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + systemctl disable --now ctrl-alt-del.target systemctl mask --now ctrl-alt-del.target diff --git a/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/not_masked.fail.sh b/linux_os/guide/system/accounts/accounts-physical/disable_ctrlaltdel_reboot/tests/not_masked.fail.sh index 74342f02..9582fbea 100644 @@ -12055,14 +5977,14 @@ index 08876d7a..ad55d965 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml b/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml -index 76e58ca5..5c48c152 100644 +index bc371853..ace64b71 100644 --- a/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Verify that Interactive Boot is Disabled' @@ -12137,17 +6059,26 @@ index 51de85f6..9f2b3780 100644 id="test_no_custom_emergency_target" version="1"> <unix:object object_ref="object_no_custom_emergency_target" /> diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml -index f9959f07..345fe440 100644 +index e2f61432..29683160 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Require Authentication for Emergency Systemd Target' +@@ -42,7 +42,7 @@ references: + srg: SRG-OS-000080-GPOS-00048 + stigid@ol7: OL07-00-010481 + stigid@rhel7: RHEL-07-010481 +- stigid@rhel8: RHEL-08-010152 ++ stigid@almalinux8: RHEL-08-010152 + + ocil_clause: 'the output is different' + @@ -50,7 +50,7 @@ ocil: |- To check if authentication is required for emergency mode, run the following command: <pre>$ grep sulogin /usr/lib/systemd/system/emergency.service</pre> @@ -12155,7 +6086,7 @@ index f9959f07..345fe440 100644 - {{% if product in ["fedora", "rhel8", "ol8"] -%}} + {{% if product in ["fedora", "rhel8", "ol8", "almalinux8"] -%}} ExecStart and /usr/lib/systemd/systemd-sulogin-shell. - <pre>ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue</pre> + <pre>ExecStart=-/usr/lib/systemd/systemd-sulogin-shell emergency</pre> {{%- else -%}} diff --git a/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/tests/correct_value.pass.sh b/linux_os/guide/system/accounts/accounts-physical/require_emergency_target_auth/tests/correct_value.pass.sh index d3cd3035..c94f7b5f 100644 @@ -12210,15 +6141,15 @@ index b022a8e2..3d7cf90c 100644 {{%- else -%}} sulogin='/bin/sh -c "/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"' diff --git a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml -index a560a3fc..29ee7109 100644 +index 49070519..605a28a0 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml +++ b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/oval/shared.xml @@ -20,7 +20,7 @@ {{%- if init_system == "systemd" -%}} <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests that -- {{% if product in ["fedora", "rhel8", "ol8"] -%}} -+ {{% if product in ["fedora", "rhel8", "ol8", "almalinux8"] -%}} +- {{% if product in ["fedora", "rhel8", "ol8", "rhcos4"] -%}} ++ {{% if product in ["fedora", "rhel8", "ol8", "rhcos4", "almalinux8"] -%}} /usr/lib/systemd/systemd-sulogin-shell {{%- else -%}} /sbin/sulogin @@ -12226,8 +6157,8 @@ index a560a3fc..29ee7109 100644 </ind:textfilecontent54_test> <ind:textfilecontent54_object id="obj_require_rescue_service" version="1"> <ind:filepath>/usr/lib/systemd/system/rescue.service</ind:filepath> -- {{%- if product in ["fedora", "rhel8", "ol8"] -%}} -+ {{%- if product in ["fedora", "rhel8", "ol8", "almalinux8"] -%}} +- {{%- if product in ["fedora", "rhel8", "ol8", "rhcos4"] -%}} ++ {{%- if product in ["fedora", "rhel8", "ol8", "rhcos4", "almalinux8"] -%}} <ind:pattern operation="pattern match">^ExecStart=\-.*/usr/lib/systemd/systemd-sulogin-shell[ ]+rescue</ind:pattern> {{%- else -%}} <ind:pattern operation="pattern match">^ExecStart=\-/bin/sh[\s]+-c[\s]+\"(/usr)?/sbin/sulogin;[\s]+/usr/bin/systemctl[\s]+--fail[\s]+--no-block[\s]+default\"</ind:pattern> @@ -12252,32 +6183,32 @@ index a560a3fc..29ee7109 100644 id="test_no_custom_runlevel1_target" version="1"> <unix:object object_ref="object_no_custom_runlevel1_target" /> diff --git a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml -index 8acaaa86..98580471 100644 +index 1ed97c35..2ad171fb 100644 --- a/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/require_singleuser_auth/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Require Authentication for Single User Mode' -@@ -44,7 +44,7 @@ references: - iso27001-2013: A.18.1.4,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,14,15,16,18,3,5 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000080-GPOS-00048 + stigid@ol7: OL07-00-010481 + stigid@rhel7: RHEL-07-010481 - stigid@rhel8: RHEL-08-010151 + stigid@almalinux8: RHEL-08-010151 ocil_clause: 'the output is different' -@@ -53,7 +53,7 @@ ocil: |- +@@ -55,7 +55,7 @@ ocil: |- To check if authentication is required for single-user mode, run the following command: <pre>$ grep sulogin /usr/lib/systemd/system/rescue.service</pre> The output should be similar to the following, and the line must begin with -- {{% if product in ["fedora", "rhel8", "ol8"] -%}} -+ {{% if product in ["fedora", "rhel8", "ol8", "almalinux8"] -%}} +- {{% if product in ["fedora", "rhel8", "ol8", "rhcos4"] -%}} ++ {{% if product in ["fedora", "rhel8", "ol8", "rhcos4", "almalinux8"] -%}} ExecStart and /usr/lib/systemd/systemd-sulogin-shell. <pre>ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue</pre> {{%- else -%}} @@ -12314,21 +6245,21 @@ index 0c544bfb..0b6fa7c1 100644 if ! grep -x ' case "$name" in sshd|login) exec tmux ;; esac' /etc/bashrc; then cat >> /etc/bashrc <<'EOF' diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml -index 2582145a..a7831c8a 100644 +index c43b8cb7..7ed86b6a 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_bashrc_exec_tmux/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8,rhcos4 -+prodtype: fedora,ol8,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Support session locking with tmux' -@@ -21,7 +21,7 @@ identifiers: - references: +@@ -23,7 +23,7 @@ references: + disa: CCI-000056 ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000031-GPOS-00012 + srg: SRG-OS-000031-GPOS-00012,SRG-OS-000028-GPOS-00009 - stigid@rhel8: RHEL-08-020041 + stigid@almalinux8: RHEL-08-020041 @@ -12355,19 +6286,19 @@ index 233047af..33549331 100644 tmux_conf="/etc/tmux.conf" diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_after_time/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_after_time/rule.yml -index fe99051e..4e725c55 100644 +index a3902b1f..dca9b85f 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_after_time/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_after_time/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8,rhcos4 -+prodtype: fedora,ol8,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure tmux to lock session after inactivity' -@@ -22,7 +22,7 @@ identifiers: - references: +@@ -24,7 +24,7 @@ references: + disa: CCI-000057 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000029-GPOS-00010 - stigid@rhel8: RHEL-08-020070 @@ -12386,26 +6317,26 @@ index f2430618..b2e711bd 100644 tmux_conf="/etc/tmux.conf" diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_command/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_command/rule.yml -index 88ce99f4..982a6f9a 100644 +index e2436ca2..fde6e6e9 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_command/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_command/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8,rhcos4 -+prodtype: fedora,ol8,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure the tmux Lock Command' -@@ -26,7 +26,7 @@ identifiers: - references: +@@ -28,7 +28,7 @@ references: disa: CCI-000056,CCI-000058 nist: AC-11(a),AC-11(b),CM-6(a) + srg: SRG-OS-000028-GPOS-00009 - stigid@rhel8: RHEL-08-020040 + stigid@almalinux8: RHEL-08-020040 - vmmsrg: SRG-OS-000028-VMM-000090,SRG-OS-000030-VMM-000110 - srg: SRG-OS-000028-GPOS-00009 + + ocil_clause: 'lock-command is not set' diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_command/tests/file_empty.fail.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_command/tests/file_empty.fail.sh index dacc9147..8a7eebd0 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_command/tests/file_empty.fail.sh @@ -12457,48 +6388,58 @@ index 45c43e8d..441cef39 100644 if grep -q 'tmux$' /etc/shells ; then sed -i '/tmux$/d' /etc/shells diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/kubernetes/shared.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/kubernetes/shared.yml -index 2c7b96bb..3e38caae 100644 +index 6b2d6cd5..c20712c9 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/kubernetes/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/rule.yml -index cd62ece7..44eb2ac3 100644 +index 595ddd6a..3df26783 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/no_tmux_in_shells/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8,rhcos4 -+prodtype: fedora,ol8,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Prevent user from disabling the screen lock' -@@ -22,7 +22,7 @@ identifiers: - references: +@@ -24,7 +24,7 @@ references: + disa: CCI-000056 ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000324-GPOS-00125 + srg: SRG-OS-000324-GPOS-00125,SRG-OS-000028-GPOS-00009 - stigid@rhel8: RHEL-08-020042 + stigid@almalinux8: RHEL-08-020042 ocil_clause: 'tmux is listed in /etc/shells' diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml -index c900612b..932d61a0 100644 +index 120d1c49..3a609963 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/package_tmux_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8,rhv4,rhcos4 -+prodtype: fedora,ol8,rhel8,almalinux8,rhv4,rhcos4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: 'Install the tmux Package' +@@ -40,7 +40,7 @@ references: + nist-csf: PR.AC-7 + ospp: FMT_MOF_EXT.1 + srg: SRG-OS-000030-GPOS-00011,SRG-OS-000028-GPOS-00009 +- stigid@rhel8: RHEL-08-020039 ++ stigid@almalinux8: RHEL-08-020039 + vmmsrg: SRG-OS-000030-VMM-000110 + + ocil_clause: 'the package is not installed' diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/ansible/shared.yml index 37602754..5834c77f 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/ansible/shared.yml @@ -12520,14 +6461,14 @@ index 4e80be4f..28db2a10 100644 # strategy = configure # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/rule.yml -index a4f72afa..8f088eb5 100644 +index 54fff733..9212c077 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Configure opensc Smart Card Drivers' @@ -12552,14 +6493,14 @@ index 7c763a87..df907379 100644 # strategy = configure # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/force_opensc_card_drivers/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/force_opensc_card_drivers/rule.yml -index 435d299d..5a22b413 100644 +index a69968b6..b895cf75 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/force_opensc_card_drivers/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/force_opensc_card_drivers/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Force opensc To Use Defined Smart Card Driver' @@ -12577,49 +6518,50 @@ index 54524233..3697fd65 100644 {{% else %}} In Red Hat Enterprise Linux servers and workstations, hardware token login diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml -index d64240dc..e8ff81fb 100644 +index 43b96404..ac689dcb 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml -@@ -1,6 +1,6 @@ +@@ -8,7 +8,7 @@ + documentation_complete: true --prodtype: fedora,ol7,rhel7,rhel8 -+prodtype: fedora,ol7,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,rhel7,rhel8,rhel9,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,rhel7,rhel8,almalinux8,rhel9,sle12,sle15,ubuntu2004 title: 'Install Smart Card Packages For Multifactor Authentication' -@@ -37,7 +37,7 @@ references: - nist: CM-6(a) +@@ -46,7 +46,7 @@ references: srg: SRG-OS-000105-GPOS-00052,SRG-OS-000375-GPOS-00160,SRG-OS-000375-GPOS-00161,SRG-OS-000377-GPOS-00162 + stigid@ol7: OL07-00-041001 stigid@rhel7: RHEL-07-041001 - stigid@rhel8: RHEL-08-010390 + stigid@almalinux8: RHEL-08-010390 - - ocil_clause: 'smartcard software is not installed' - + stigid@sle12: SLES-12-030500 + stigid@sle15: SLES-15-010460 + stigid@ubuntu2004: UBTU-20-010063 diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_opensc_installed/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_opensc_installed/rule.yml -index 74da38fa..ecc1cfe9 100644 +index 5d88eb4d..f4d70ff2 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_opensc_installed/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_opensc_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004 title: 'Install the opensc Package For Multifactor Authentication' -@@ -31,7 +31,7 @@ references: - srg: SRG-OS-000375-GPOS-00160 - vmmsrg: SRG-OS-000376-VMM-001520 +@@ -35,7 +35,7 @@ references: ism: 1382,1384,1386 + nist: CM-6(a) + srg: SRG-OS-000375-GPOS-00160,SRG-OS-000376-GPOS-00161 - stigid@rhel8: RHEL-08-010410 + stigid@almalinux8: RHEL-08-010410 - - ocil_clause: 'the package is not installed' + stigid@ubuntu2004: UBTU-20-010064 + vmmsrg: SRG-OS-000376-VMM-001520 diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_pcsc-lite_installed/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_pcsc-lite_installed/rule.yml -index e2a96fa2..2e308fa7 100644 +index 0652fbea..215abe8b 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_pcsc-lite_installed/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/package_pcsc-lite_installed/rule.yml @@ -1,6 +1,6 @@ @@ -12631,7 +6573,7 @@ index e2a96fa2..2e308fa7 100644 title: 'Install the pcsc-lite package' diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/service_pcscd_enabled/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/service_pcscd_enabled/rule.yml -index cc45c990..46330fa5 100644 +index 23a63bf4..05eb3b88 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/service_pcscd_enabled/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/service_pcscd_enabled/rule.yml @@ -1,6 +1,6 @@ @@ -12642,35 +6584,6 @@ index cc45c990..46330fa5 100644 title: 'Enable the pcscd Service' -diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml -index 12203253..d0796096 100644 ---- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml -+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_auth/rule.yml -@@ -5,23 +5,7 @@ prodtype: fedora,ol7,rhel7 - title: 'Enable Smart Card Login' - - description: |- -- To enable smart card authentication, consult the documentation at: -- <ul> -- {{% if product == "rhel7" %}} -- <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards") }}}</b></li> -- {{% elif product == "rhel8" %}} -- <li><b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/smartcards.html#authconfig-smartcards") }}}</b></li> -- {{% elif product == "ol7" %}} -- <li><b>{{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-s4-auth.html") }}}</b></li> -- {{% endif %}} -- </ul> -- -- {{% if product != "ol7" %}} -- For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at: -- <ul> -- <li><b>{{{ weblink(link="https://access.redhat.com/solutions/82273") }}}</b></li> -- </ul> -- {{% endif %}} -+ To enable smart card authentication, consult the documentation. - - rationale: |- - Smart card login provides two-factor authentication stronger than diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_configure_cert_checking/bash/shared.sh b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_configure_cert_checking/bash/shared.sh index d02a9674..9bdafdc1 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_configure_cert_checking/bash/shared.sh @@ -12682,48 +6595,49 @@ index d02a9674..9bdafdc1 100644 # Install required packages if ! rpm --quiet -q pam_pkcs11; then yum -y -d 1 install pam_pkcs11; fi diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_configure_cert_checking/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_configure_cert_checking/rule.yml -index 1088282c..da5f46af 100644 +index 73185c44..61701686 100644 --- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_configure_cert_checking/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/smartcard_configure_cert_checking/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,sle12,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,sle12,sle15,ubuntu2004 title: 'Configure Smart Card Certificate Status Checking' diff --git a/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/kubernetes/shared.yml b/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/kubernetes/shared.yml -index 85d8288f..9e5cf3f3 100644 +index ff493491..082c8e61 100644 --- a/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhv,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhv,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/rule.yml b/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/rule.yml -index 1f712eed..e32ac69e 100644 +index 157ef461..be23be4f 100644 --- a/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/rule.yml +++ b/linux_os/guide/system/accounts/accounts-physical/service_debug-shell_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable debug-shell SystemD Service' -@@ -32,7 +32,7 @@ references: +@@ -34,7 +34,7 @@ references: hipaa: 164.308(a)(1)(ii)(B),164.308(a)(7)(i),164.308(a)(7)(ii)(A),164.310(a)(1),164.310(a)(2)(i),164.310(a)(2)(ii),164.310(a)(2)(iii),164.310(b),164.310(c),164.310(d)(1),164.310(d)(2)(iii) ospp: FIA_UAU.1 - srg: SRG-OS-000324-GPOS-00125 + srg: SRG-OS-000324-GPOS-00125,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040180 + stigid@almalinux8: RHEL-08-040180 - ocil: '{{{ ocil_service_disabled(service="debug-shell") }}}' - + ocil: |- + {{{ ocil_service_disabled(service="debug-shell") }}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/ansible/shared.yml index 74598bc7..680caf4b 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/ansible/shared.yml @@ -12745,46 +6659,120 @@ index c8c2a90e..c42ae5d6 100644 {{{ bash_instantiate_variables("var_account_disable_post_pw_expiration") }}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml -index 7e6b5d79..0d6bdb24 100644 +index a3d81cf7..7b20a031 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_disable_post_pw_expiration/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Set Account Expiration Following Inactivity' -@@ -47,7 +47,7 @@ references: - cobit5: DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.12.4.1,A.12.4.3,A.18.1.4,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,12,13,14,15,16,18,3,5,7,8 +@@ -51,7 +51,7 @@ references: + srg: SRG-OS-000118-GPOS-00060 + stigid@ol7: OL07-00-010310 + stigid@rhel7: RHEL-07-010310 - stigid@rhel8: RHEL-08-020260 + stigid@almalinux8: RHEL-08-020260 + stigid@sle12: SLES-12-010340 + stigid@sle15: SLES-15-020050 + stigid@ubuntu2004: UBTU-20-010409 +diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml +index a47c7f39..a935a880 100644 +--- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_emergency_expire_date/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true - ocil_clause: 'the value of INACTIVE is greater than the expected value' +-prodtype: fedora,rhel8 ++prodtype: fedora,rhel8,almalinux8 + title: 'Assign Expiration Date to Emergency Accounts' + +@@ -40,7 +40,7 @@ references: + nist: AC-2(2),AC-2(3),CM-6(a) + nist-csf: DE.CM-1,DE.CM-3,PR.AC-1,PR.AC-4,PR.AC-6 + srg: SRG-OS-000123-GPOS-00064,SRG-OS-000002-GPOS-00002 +- stigid@rhel8: RHEL-08-020270 ++ stigid@almalinux8: RHEL-08-020270 + vmmsrg: SRG-OS-000002-VMM-000020,SRG-OS-000123-VMM-000620 + + ocil_clause: 'any emergency accounts have no expiration date set or do not expire within a documented time frame' diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_temp_expire_date/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_temp_expire_date/rule.yml -index c3a2a13b..0825c6e9 100644 +index b4f3688c..54de04ff 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_temp_expire_date/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/account_expiration/account_temp_expire_date/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,rhv4,sle12 -+prodtype: fedora,rhel7,rhel8,almalinux8,rhv4,sle12 +-prodtype: fedora,rhel7,rhel8,rhv4,sle12,sle15,ubuntu2004 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu2004 title: 'Assign Expiration Date to Temporary Accounts' -@@ -44,7 +44,7 @@ references: - iso27001-2013: A.12.4.1,A.12.4.3,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,12,13,14,15,16,18,3,5,7,8 - stigid@sle12: SLES-12-010360 +@@ -43,7 +43,7 @@ references: + nist: AC-2(2),AC-2(3),CM-6(a) + nist-csf: DE.CM-1,DE.CM-3,PR.AC-1,PR.AC-4,PR.AC-6 + srg: SRG-OS-000123-GPOS-00064,SRG-OS-000002-GPOS-00002 - stigid@rhel8: RHEL-08-020000 + stigid@almalinux8: RHEL-08-020000 + stigid@sle12: SLES-12-010360 + stigid@sle15: SLES-15-020000 + stigid@ubuntu2004: UBTU-20-010000 +diff --git a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml +index 5cfdf48d..16e11ddb 100644 +--- a/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-restrictions/account_unique_id/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true - ocil_clause: 'any temporary or emergency accounts have no expiration date set or do not expire within a documented time frame' +-prodtype: fedora,ol7,ol8,rhel7,rhel8,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle12,sle15 + + title: 'Ensure All Accounts on the System Have Unique User IDs' + +@@ -21,7 +21,7 @@ references: + disa: CCI-000764,CCI-000804 + nist@sle12: IA-2,IA-2.1,IA-8,IA-8.1 + srg: SRG-OS-000104-GPOS-00051,SRG-OS-000121-GPOS-00062,SRG-OS-000042-GPOS-00020 +- stigid@rhel8: RHEL-08-020240 ++ stigid@almalinux8: RHEL-08-020240 + stigid@sle12: SLES-12-010640 + stigid@sle15: SLES-15-010230 + +diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml +index e2311f6a..9c02a9f1 100644 +--- a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: ol7,sle12,sle15,fedora,rhel8 ++prodtype: ol7,sle12,sle15,fedora,rhel8,almalinux8 + + title: 'Only Authorized Local User Accounts Exist on Operating System' + +@@ -34,7 +34,7 @@ references: + disa: CCI-000366 + nist@sle12: CM-6(b),CM-6.1(iv) + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-020320 ++ stigid@almalinux8: RHEL-08-020320 + stigid@sle12: SLES-12-010630 + stigid@sle15: SLES-15-020090 + +diff --git a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh +index d942f81d..bcafb5e8 100644 +--- a/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh ++++ b/linux_os/guide/system/accounts/accounts-restrictions/accounts_authorized_local_users/tests/default.pass.sh +@@ -1,5 +1,5 @@ + #! /bin/bash +-# platform = multi_platform_rhel ++# platform = multi_platform_rhel,multi_platform_almalinux + + var_accounts_authorized_local_users_regex="^(root|bin|daemon|adm|lp|sync|shutdown|halt|mail|operator|games|ftp|nobody|pegasus|systemd-bus-proxy|systemd-network|dbus|polkitd|abrt|unbound|tss|libstoragemgmt|rpc|colord|usbmuxd$|pcp|saslauth|geoclue|setroubleshoot|rtkit|chrony|qemu|radvd|rpcuser|nfsnobody|pulse|gdm|gnome-initial-setup|postfix|avahi|ntp|sshd|tcpdump|oprofile|uuidd)$" diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/ansible/shared.yml index bed135a4..1df8f3a2 100644 @@ -12807,18 +6795,18 @@ index 135eb49d..2ad49f24 100644 {{{ bash_instantiate_variables("var_accounts_maximum_age_login_defs") }}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml -index 15ccf530..f5627a09 100644 +index 1a0f05a7..af196b8f 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_maximum_age_login_defs/rule.yml -@@ -47,7 +47,7 @@ references: - iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - ism: 0418,1055,1402 +@@ -51,7 +51,7 @@ references: + srg: SRG-OS-000076-GPOS-00044 + stigid@ol7: OL07-00-010250 + stigid@rhel7: RHEL-07-010250 - stigid@rhel8: RHEL-08-020200 + stigid@almalinux8: RHEL-08-020200 - - ocil_clause: 'PASS_MAX_DAYS is not set equal to or greater than the required value' - + stigid@sle12: SLES-12-010280 + stigid@sle15: SLES-15-020220 + stigid@ubuntu2004: UBTU-20-010008 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/ansible/shared.yml index 0c81c0ee..29f31c65 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/ansible/shared.yml @@ -12829,29 +6817,19 @@ index 0c81c0ee..29f31c65 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/bash/shared.sh -index 870b5b1c..8086a390 100644 ---- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol,multi_platform_rhv -+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol,multi_platform_rhv - . /usr/share/scap-security-guide/remediation_functions - {{{ bash_instantiate_variables("var_accounts_minimum_age_login_defs") }}} - diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml -index 36a611e3..64653d2e 100644 +index 0b777e36..2096018a 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_minimum_age_login_defs/rule.yml -@@ -45,7 +45,7 @@ references: - cis-csc: 1,12,15,16,5 - cis@rhel8: 5.5.1.2 - ism: 0418,1055,1402 +@@ -49,7 +49,7 @@ references: + srg: SRG-OS-000075-GPOS-00043 + stigid@ol7: OL07-00-010230 + stigid@rhel7: RHEL-07-010230 - stigid@rhel8: RHEL-08-020190 + stigid@almalinux8: RHEL-08-020190 - - ocil_clause: 'it is not equal to or greater than the required value' - + stigid@sle12: SLES-12-010270 + stigid@sle15: SLES-15-020200 + stigid@ubuntu2004: UBTU-20-010007 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/ansible/shared.yml index eee37bda..a231fa41 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/ansible/shared.yml @@ -12863,23 +6841,23 @@ index eee37bda..a231fa41 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/bash/shared.sh -index eb412139..14568ee2 100644 +index 0b47d1f4..2a4f751b 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/bash/shared.sh @@ -1,4 +1,4 @@ -# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel +# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux . /usr/share/scap-security-guide/remediation_functions - declare var_accounts_password_minlen_login_defs {{{ bash_instantiate_variables("var_accounts_password_minlen_login_defs") }}} + diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/rule.yml -index f9884fd9..e35042d7 100644 +index f65c2d2b..d93a45d8 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_minlen_login_defs/rule.yml -@@ -42,7 +42,7 @@ references: - cis-csc: 1,12,15,16,5 +@@ -45,7 +45,7 @@ references: + nist-csf: PR.AC-1,PR.AC-6,PR.AC-7 + ospp: FMT_MOF_EXT.1 srg: SRG-OS-000078-GPOS-00046 - ism: 0421,0422,0431,0974,1173,1401,1504,1505,1546,1557,1558,1559,1560,1561 - stigid@rhel8: RHEL-08-020231 + stigid@almalinux8: RHEL-08-020231 @@ -12949,47 +6927,47 @@ index 88ecd439..678d3b6d 100644 sed -i "/^PASS_MIN_LEN.*/d" /etc/login.defs diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/rule.yml -index 0ef1fcfe..a7b31ebc 100644 +index 8b5e0962..faa4da48 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_max_life_existing/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Set Existing Passwords Maximum Age' @@ -31,7 +31,7 @@ references: - vmmsrg: SRG-OS-000076-VMM-000430 + srg: SRG-OS-000076-GPOS-00044 + stigid@ol7: OL07-00-010260 stigid@rhel7: RHEL-07-010260 - stigid@sle12: SLES-12-010290 - stigid@rhel8: RHEL-08-020210 + stigid@almalinux8: RHEL-08-020210 - - ocil_clause: 'existing passwords are not configured correctly' - + stigid@sle12: SLES-12-010290 + stigid@sle15: SLES-15-020230 + vmmsrg: SRG-OS-000076-VMM-000430 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_min_life_existing/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_min_life_existing/rule.yml -index cc073067..ddd81b28 100644 +index b250979f..bfe4e52b 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_min_life_existing/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_min_life_existing/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Set Existing Passwords Minimum Age' -@@ -31,7 +31,7 @@ references: - vmmsrg: SRG-OS-000075-VMM000420 +@@ -32,7 +32,7 @@ references: + srg: SRG-OS-000075-GPOS-00043 + stigid@ol7: OL07-00-010240 stigid@rhel7: RHEL-07-010240 - stigid@sle12: SLES-12-010260 - stigid@rhel8: RHEL-08-020180 + stigid@almalinux8: RHEL-08-020180 - - ocil_clause: 'existing passwords are not configured correctly' - + stigid@sle12: SLES-12-010260 + stigid@sle15: SLES-15-020210 + vmmsrg: SRG-OS-000075-VMM000420 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/ansible/shared.yml index 1091f8c8..00da1b03 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/ansible/shared.yml @@ -13000,15 +6978,26 @@ index 1091f8c8..00da1b03 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/bash/shared.sh -index 800eecc8..013554db 100644 ---- a/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_warn_age_login_defs/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4 -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4 - . /usr/share/scap-security-guide/remediation_functions - {{{ bash_instantiate_variables("var_accounts_password_warn_age_login_defs") }}} +diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml +index d3a1b85c..1353a811 100644 +--- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml ++++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_all_shadowed_sha512/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8,sle12,sle15,ubuntu2004 ++prodtype: fedora,rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Verify All Account Password Hashes are Shadowed with SHA512' + +@@ -34,7 +34,7 @@ references: + disa: CCI-000196,CCI-000803 + nist: IA-5(1)(c),IA-5(1).1(v),IA-7,IA-7.1 + srg: SRG-OS-000073-GPOS-00041,SRG-OS-000120-GPOS-00061 +- stigid@rhel8: RHEL-08-010120 ++ stigid@almalinux8: RHEL-08-010120 + stigid@sle12: SLES-12-010220 + stigid@sle15: SLES-15-020180 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/ansible/shared.yml index 85f98d2f..4f2f1232 100644 @@ -13031,17 +7020,26 @@ index 258a7615..ef4ea1fc 100644 {{{ bash_instantiate_variables("var_password_pam_unix_rounds") }}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/rule.yml -index 5c605e71..5ac06a9e 100644 +index 459692f4..2fbcc118 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_password_auth/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Set number of Password Hashing Rounds - password-auth' +@@ -32,7 +32,7 @@ references: + anssi: BP28(R32) + disa: CCI-000196 + srg: SRG-OS-000073-GPOS-00041 +- stigid@rhel8: RHEL-08-010130 ++ stigid@almalinux8: RHEL-08-010130 + + ocil_clause: 'it does not set the appropriate number of hashing rounds' + diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/ansible/shared.yml index e7dccf38..21382076 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/ansible/shared.yml @@ -13063,17 +7061,26 @@ index b2c81662..b6a5e1f1 100644 {{{ bash_instantiate_variables("var_password_pam_unix_rounds") }}} diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml -index 7a8c816e..3b20bfe4 100644 +index 0b694b0e..314c0a1f 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/accounts_password_pam_unix_rounds_system_auth/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Set number of Password Hashing Rounds - system-auth' +@@ -32,7 +32,7 @@ references: + anssi: BP28(R32) + disa: CCI-000196 + srg: SRG-OS-000073-GPOS-00041 +- stigid@rhel8: RHEL-08-010131 ++ stigid@almalinux8: RHEL-08-010131 + + ocil_clause: 'it does not set the appropriate number of hashing rounds' + diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/ansible/shared.yml index db35dac3..b5c8d349 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/ansible/shared.yml @@ -13094,27 +7101,28 @@ index 837c46b2..cf1e4f4d 100644 sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/system-auth sed --follow-symlinks -i 's/\<nullok\>//g' /etc/pam.d/password-auth diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/kubernetes/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/kubernetes/shared.yml -index 288d0b8b..43d9f31a 100644 +index 075cc631..47e67288 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/kubernetes/shared.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos +# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml -index df6da6b9..b71df51a 100644 +index 75f988ff..d5a15e3b 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords/rule.yml -@@ -45,7 +45,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.02,DSS06.03,DSS06.10 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.18.1.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,12,13,14,15,16,18,3,5 -- stigid@rhel8: sshd_disable_empty_passwords -+ stigid@almalinux8: sshd_disable_empty_passwords - - ocil_clause: 'NULL passwords can be used' +@@ -53,7 +53,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-010290 + stigid@rhel7: RHEL-07-010290 +- stigid@rhel8: RHEL-08-020331 ++ stigid@almalinux8: RHEL-08-020331 + stigid@sle12: SLES-12-010231 + stigid@sle15: SLES-15-020300 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/ansible/shared.yml index acf0496e..7f1fb69d 100644 @@ -13126,25 +7134,15 @@ index acf0496e..7f1fb69d 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/bash/shared.sh -index 524cf10d..8aeec4e0 100644 ---- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat OpenShift Container Platform 4,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat OpenShift Container Platform 4,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4 - - if grep -q '^\+' /etc/group; then - # backup old file to /etc/group- diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/rule.yml -index ba40c093..5688cafc 100644 +index 126f2ba5..9c45e22a 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_group/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Ensure there are no legacy + NIS entries in /etc/group' @@ -13158,25 +7156,15 @@ index 5baef258..84ddc1e0 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/bash/shared.sh -index 4bb73e01..4223e2d1 100644 ---- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat OpenShift Container Platform 4,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat OpenShift Container Platform 4,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4 - - if grep -q '^\+' /etc/passwd; then - # backup old file to /etc/passwd- diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/rule.yml -index ef2266df..22e139b5 100644 +index 12e9a125..6bf3b7cc 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_passwd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Ensure there are no legacy + NIS entries in /etc/passwd' @@ -13190,48 +7178,30 @@ index c969414d..7b71e4ce 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/bash/shared.sh -index f8874c9f..e7655a31 100644 ---- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat OpenShift Container Platform 4,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat OpenShift Container Platform 4,Oracle Linux 7,Oracle Linux 8,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4 - - if grep -q '^\+' /etc/shadow; then - # backup old file to /etc/shadow- diff --git a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/rule.yml -index 687bbde8..f16f07eb 100644 +index 102c4def..9dd2ada2 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_legacy_plus_entries_etc_shadow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Ensure there are no legacy + NIS entries in /etc/shadow' -diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/bash/shared.sh b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/bash/shared.sh -index 02277be1..5734684c 100644 ---- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/bash/shared.sh -@@ -1,2 +1,2 @@ --# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol,multi_platform_rhv,multi_platform_sle -+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol,multi_platform_rhv,multi_platform_sle - awk -F: '$3 == 0 && $1 != "root" { print $1 }' /etc/passwd | xargs --max-lines=1 passwd -l diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml -index 6b3c71fa..0231bf8b 100644 +index edde64a7..69be3dfb 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/rule.yml -@@ -42,7 +42,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.02,DSS06.03,DSS06.10 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.18.1.4,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,12,13,14,15,16,18,3,5 +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020310 + stigid@rhel7: RHEL-07-020310 - stigid@rhel8: RHEL-08-040200 + stigid@almalinux8: RHEL-08-040200 - - ocil_clause: 'any account other than root has a UID of 0' + stigid@sle12: SLES-12-010650 + stigid@sle15: SLES-15-020100 diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/ansible/shared.yml index 6fbb7c72..d8e71c19 100644 @@ -13244,10 +7214,11 @@ index 6fbb7c72..d8e71c19 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/kubernetes/shared.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/kubernetes/shared.yml -index c504acf6..33454d53 100644 +index 8f87bf06..6bed5ef5 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/kubernetes/shared.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_direct_root_logins/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 @@ -13266,14 +7237,14 @@ index b5bfabab..6742eeb2 100644 title: 'Restrict Web Browser Use for Administrative Accounts' diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/rule.yml -index e47a67a2..a3859a0e 100644 +index 5129557e..08dcd47d 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/no_shelllogin_for_systemaccounts/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle12,sle15,ubuntu2004 title: 'Ensure that System Accounts Do Not Run a Shell Upon Login' @@ -13288,7 +7259,7 @@ index 5f9c92aa..119219eb 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/root_path_default/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/root_path_default/rule.yml -index 947c9f77..8ce86ec8 100644 +index 84560835..c0f76497 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/root_path_default/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/root_path_default/rule.yml @@ -1,6 +1,6 @@ @@ -13331,14 +7302,14 @@ index d001e733..7c7000ed 100644 # uncomment the option if commented sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_for_su/rule.yml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_for_su/rule.yml -index 4cd0aaa8..b2729656 100644 +index 20648132..c1b3d384 100644 --- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_for_su/rule.yml +++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/use_pam_wheel_for_su/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu2004 title: 'Enforce usage of pam_wheel for su authentication' @@ -13362,7 +7333,7 @@ index be3cc99c..6770cf9e 100644 {{{ set_config_file("/etc/login.defs", "CREATE_HOME", "yes", create=true, insert_after="", insert_before="^\s*CREATE_HOME", insensitive=true) }}} diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_have_homedir_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_have_homedir_login_defs/rule.yml -index 9e19b908..563b28de 100644 +index f478f78e..1f3c358d 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_have_homedir_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_have_homedir_login_defs/rule.yml @@ -1,6 +1,6 @@ @@ -13375,46 +7346,46 @@ index 9e19b908..563b28de 100644 @@ -29,7 +29,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020610 stigid@rhel7: RHEL-07-020610 - stigid@sle12: SLES-12-010720 - stigid@rhel8: RHEL-08-010760 + stigid@almalinux8: RHEL-08-010760 - - ocil_clause: 'the value of CREATE_HOME is not set to yes, is missing, or the line is commented out' + stigid@sle12: SLES-12-010720 + stigid@sle15: SLES-15-020110 diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/ansible/shared.yml -index cafb637d..e265ecc8 100644 +index 53b68079..2a6b6612 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_sle -+# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_almalinux,multi_platform_sle +-# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_sle,multi_platform_ol ++# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_almalinux,multi_platform_sle,multi_platform_ol # disruption = low # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/bash/shared.sh -index a8a77c12..9a0dab76 100644 +index a352897a..b42bcca5 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/bash/shared.sh +++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_wrlinux -+# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux +-# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_wrlinux,multi_platform_ol ++# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux,multi_platform_ol # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml -index d1da3b69..a6af99f3 100644 +index 3d7c3771..b839c129 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_logon_fail_delay/rule.yml @@ -31,7 +31,7 @@ references: - cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05 - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 + srg: SRG-OS-000480-GPOS-00226 + stigid@ol7: OL07-00-010430 + stigid@rhel7: RHEL-07-010430 - stigid@rhel8: RHEL-08-020310 + stigid@almalinux8: RHEL-08-020310 + stigid@sle12: SLES-12-010140 ocil_clause: 'the above command returns no output, or FAIL_DELAY is configured less than the expected value' - diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/ansible/shared.yml index 536ac295..d1bff5ff 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/ansible/shared.yml @@ -13436,18 +7407,18 @@ index 65066e77..fd616495 100644 {{{ bash_instantiate_variables("var_accounts_max_concurrent_login_sessions") }}} diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml -index 5787380d..8e8921f3 100644 +index 5ac0a7db..aa22264c 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_max_concurrent_login_sessions/rule.yml -@@ -37,7 +37,7 @@ references: - cobit5: DSS01.05,DSS05.02 - iso27001-2013: A.13.1.1,A.13.1.3,A.13.2.1,A.14.1.2,A.14.1.3 - cis-csc: 14,15,18,9 +@@ -38,7 +38,7 @@ references: + srg: SRG-OS-000027-GPOS-00008 + stigid@ol7: OL07-00-040000 + stigid@rhel7: RHEL-07-040000 - stigid@rhel8: RHEL-08-020024 + stigid@almalinux8: RHEL-08-020024 - - ocil_clause: 'maxlogins is not equal to or less than the expected value' - + stigid@sle12: SLES-12-010120 + stigid@sle15: SLES-15-020020 + stigid@ubuntu2004: UBTU-20-010400 diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_tmp/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_tmp/ansible/shared.yml index 1bd99ce7..a4f03471 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_tmp/ansible/shared.yml @@ -13458,16 +7429,6 @@ index 1bd99ce7..a4f03471 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_tmp/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_tmp/bash/shared.sh -index 652c914c..d501a3fb 100644 ---- a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_tmp/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_tmp/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 - if ! [ -d /tmp/tmp-inst ] ; then - mkdir --mode 000 /tmp/tmp-inst - fi diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_var_tmp/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_var_tmp/ansible/shared.yml index 81a86072..678586dd 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_var_tmp/ansible/shared.yml @@ -13478,18 +7439,8 @@ index 81a86072..678586dd 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_var_tmp/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_var_tmp/bash/shared.sh -index 38e95a8c..b47178b9 100644 ---- a/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_var_tmp/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-session/accounts_polyinstantiated_var_tmp/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 - if ! [ -d /tmp-inst ] ; then - mkdir --mode 000 /var/tmp/tmp-inst - fi diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml -index 2c304900..73892b52 100644 +index f37ac948..dc8eb410 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -13498,195 +7449,185 @@ index 2c304900..73892b52 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh -index ba01c7ec..b0ff7425 100644 ---- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_wrlinux - . /usr/share/scap-security-guide/remediation_functions - {{{ bash_instantiate_variables("var_accounts_tmout") }}} - diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml -index 895290d0..3f8b5c3e 100644 +index 7d90a3f6..89b62218 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_tmout/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Set Interactive Session Timeout' diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/rule.yml -index 1bcfca2b..2335b0b4 100644 +index a9cf96af..b988b245 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_group_ownership/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,ubuntu2004,wrlinux1019 title: 'User Initialization Files Must Be Group-Owned By The Primary User' diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_no_world_writable_programs/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_no_world_writable_programs/rule.yml -index d41cc0cc..56976bda 100644 +index 13019f6d..53c7cbb7 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_no_world_writable_programs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_no_world_writable_programs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12,sle15 title: 'User Initialization Files Must Not Run World-Writable Programs' @@ -29,7 +29,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020730 stigid@rhel7: RHEL-07-020730 - stigid@sle12: SLES-12-010780 - stigid@rhel8: RHEL-08-010660 + stigid@almalinux8: RHEL-08-010660 - - ocil_clause: 'files are executing world-writable programs' + stigid@sle12: SLES-12-010780 + stigid@sle15: SLES-15-040130 diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/rule.yml -index da6dd8ed..9a1af6b8 100644 +index 37efb159..e74c5317 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_dot_user_ownership/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,ubuntu2004,wrlinux1019 title: 'User Initialization Files Must Be Owned By the Primary User' diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_home_paths_only/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_home_paths_only/rule.yml -index 14392044..ce4a12e3 100644 +index f49c5a9e..e44c3f42 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_home_paths_only/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_home_paths_only/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12,sle15 title: 'Ensure that Users Path Contains Only Local Directories' @@ -33,7 +33,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020720 stigid@rhel7: RHEL-07-020720 - stigid@sle12: SLES-12-010770 - stigid@rhel8: RHEL-08-010690 + stigid@almalinux8: RHEL-08-010690 - - ocil_clause: 'paths contain more than local home directories' + stigid@sle12: SLES-12-010770 + stigid@sle15: SLES-15-040120 diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_defined/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_defined/rule.yml -index a4cf5c2b..26a464df 100644 +index 1863ab76..f9548568 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_defined/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_defined/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12,sle15 title: 'All Interactive Users Must Have A Home Directory Defined' @@ -25,7 +25,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020600 stigid@rhel7: RHEL-07-020600 - stigid@sle12: SLES-12-010710 - stigid@rhel8: RHEL-08-010720 + stigid@almalinux8: RHEL-08-010720 - - ocil_clause: 'users home directory is not defined' + stigid@sle12: SLES-12-010710 + stigid@sle15: SLES-15-040070 diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml -index 1c8fb04d..1611a2fa 100644 +index 8a111943..db4fdd25 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_user_interactive_home_directory_exists/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'All Interactive Users Home Directories Must Exist' -@@ -31,7 +31,7 @@ references: +@@ -33,7 +33,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020620 stigid@rhel7: RHEL-07-020620 - cis@rhel8: 6.2.20 - stigid@sle12: SLES-12-010730 - stigid@rhel8: RHEL-08-010750 + stigid@almalinux8: RHEL-08-010750 - - ocil_clause: 'users home directory does not exist' + stigid@sle12: SLES-12-010730 + stigid@sle15: SLES-15-040080 diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/rule.yml -index e3e46f02..36966e35 100644 +index 1c0f93ad..720a5a8f 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_groupownership/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle15 title: 'All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary User' diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml -index 27399983..98cbac46 100644 +index 13f6bfe2..770562eb 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_ownership/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle15 title: 'All User Files and Directories In The Home Directory Must Be Owned By The Primary User' diff --git a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/rule.yml b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/rule.yml -index fb57ff10..38beb341 100644 +index c434cc96..15e0bb4c 100644 --- a/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/accounts_users_home_files_permissions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle15 title: 'All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive' diff --git a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml -index 6c70cc8a..b3bf758c 100644 +index 2e6ce604..2b44a8e6 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/file_groupownership_home_directories/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'All Interactive User Home Directories Must Be Group-Owned By The Primary User' -@@ -30,7 +30,7 @@ references: +@@ -32,7 +32,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020650 stigid@rhel7: RHEL-07-020650 - cis@rhel8: 6.2.8 - stigid@sle12: SLES-12-010750 - stigid@rhel8: RHEL-08-010740 + stigid@almalinux8: RHEL-08-010740 - - ocil_clause: 'the group ownership is incorrect' + stigid@sle12: SLES-12-010750 + stigid@sle15: SLES-15-040100 diff --git a/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml -index 37cb36cd..173d831d 100644 +index 198a9be7..c13180b4 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/file_ownership_home_directories/rule.yml @@ -1,6 +1,6 @@ @@ -13698,49 +7639,49 @@ index 37cb36cd..173d831d 100644 title: 'All Interactive User Home Directories Must Be Owned By The Primary User' diff --git a/linux_os/guide/system/accounts/accounts-session/file_permission_user_init_files/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_permission_user_init_files/rule.yml -index ef628020..0dafaaf4 100644 +index 5244533a..62ef0971 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_permission_user_init_files/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/file_permission_user_init_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Ensure All User Initialization Files Have Mode 0740 Or Less Permissive' -@@ -27,7 +27,7 @@ references: +@@ -28,7 +28,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020710 stigid@rhel7: RHEL-07-020710 - stigid@sle12: SLES-12-010760 - stigid@rhel8: RHEL-08-010770 + stigid@almalinux8: RHEL-08-010770 - - ocil_clause: 'they are not 0740 or more permissive' + stigid@sle12: SLES-12-010760 + stigid@sle15: SLES-15-040110 diff --git a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_directories/rule.yml b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_directories/rule.yml -index 561f9f13..c341a286 100644 +index 1f7a5ffa..30b8be81 100644 --- a/linux_os/guide/system/accounts/accounts-session/file_permissions_home_directories/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/file_permissions_home_directories/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'All Interactive User Home Directories Must Have mode 0750 Or Less Permissive' -@@ -27,7 +27,7 @@ references: +@@ -29,7 +29,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020630 stigid@rhel7: RHEL-07-020630 - stigid@sle12: SLES-12-010740 - stigid@rhel8: RHEL-08-010730 + stigid@almalinux8: RHEL-08-010730 - - ocil_clause: 'they are more permissive' + stigid@sle12: SLES-12-010740 + stigid@sle15: SLES-15-040090 diff --git a/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml b/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml -index ee5a118f..d939ce3d 100644 +index 4e7ea875..ecbce672 100644 --- a/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml +++ b/linux_os/guide/system/accounts/accounts-session/root_paths/accounts_root_path_dirs_no_write/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -13760,26 +7701,38 @@ index a8301696..ec78ad7a 100644 {{{ bash_instantiate_variables("var_accounts_user_umask") }}} diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml -index e06ae361..995d89bd 100644 +index aa763481..6ac17762 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Ensure the Default Bash Umask is Set Correctly' -@@ -32,7 +32,7 @@ references: - iso27001-2013: A.14.1.1,A.14.2.1,A.14.2.5,A.6.1.5 - cis-csc: '18' - srg: SRG-OS-000480-GPOS-00228 +@@ -37,7 +37,7 @@ references: + nist: AC-6(1),CM-6(a) + nist-csf: PR.IP-2 + srg: SRG-OS-000480-GPOS-00228,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-020353 + stigid@almalinux8: RHEL-08-020353 ocil_clause: 'the above command returns no output, or if the umask is configured incorrectly' +diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/tests/stig_correct.pass.sh b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/tests/stig_correct.pass.sh +index eaaf1d3b..c5abfe41 100644 +--- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/tests/stig_correct.pass.sh ++++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_bashrc/tests/stig_correct.pass.sh +@@ -1,6 +1,6 @@ + #!/bin/bash + # profiles = xccdf_org.ssgproject.content_profile_stig +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + + sed -i '/umask/d' /etc/bashrc + echo "umask 077" >> /etc/bashrc diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/bash/shared.sh index 716dede4..51ce94dd 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/bash/shared.sh @@ -13791,14 +7744,14 @@ index 716dede4..51ce94dd 100644 {{{ bash_instantiate_variables("var_accounts_user_umask") }}} diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/rule.yml -index fba52972..e84c410e 100644 +index 1b71c7d3..cfa4fecc 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_csh_cshrc/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,sle15,ubuntu2004 title: 'Ensure the Default C Shell Umask is Set Correctly' @@ -13823,123 +7776,364 @@ index f74cbfe5..b418c6da 100644 {{{ bash_instantiate_variables("var_accounts_user_umask") }}} diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_login_defs/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_login_defs/rule.yml -index 0c86e6e9..28921dba 100644 +index 51f8e51f..23fa9ee3 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_login_defs/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_login_defs/rule.yml -@@ -33,7 +33,7 @@ references: - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.1.1,A.14.2.1,A.14.2.2,A.14.2.3,A.14.2.4,A.14.2.5,A.6.1.5 - cis-csc: 11,18,3,9 - anssi: BP28(R35) +@@ -38,7 +38,7 @@ references: + srg: SRG-OS-000480-GPOS-00228 + stigid@ol7: OL07-00-020240 + stigid@rhel7: RHEL-07-020240 - stigid@rhel8: RHEL-08-020351 + stigid@almalinux8: RHEL-08-020351 - - ocil_clause: 'the above command returns no output, or if the umask is configured incorrectly' - -diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_profile/bash/shared.sh b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_profile/bash/shared.sh -index 12acd6e9..ab830fbd 100644 ---- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_profile/bash/shared.sh -+++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_etc_profile/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_wrlinux,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_wrlinux,multi_platform_ol - . /usr/share/scap-security-guide/remediation_functions - {{{ bash_instantiate_variables("var_accounts_user_umask") }}} - + stigid@sle12: SLES-12-010620 + stigid@sle15: SLES-15-040420 + stigid@ubuntu2004: UBTU-20-010016 diff --git a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml -index f3648011..09d3ac95 100644 +index 36032c66..08f847a7 100644 --- a/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml +++ b/linux_os/guide/system/accounts/accounts-session/user_umask/accounts_umask_interactive_users/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Ensure the Default Umask is Set Correctly For Interactive Users' -@@ -25,7 +25,7 @@ references: - disa: CCI-000366,CCI-001814 +@@ -26,7 +26,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021040 stigid@rhel7: RHEL-07-021040 - stigid@rhel8: RHEL-08-020352 + stigid@almalinux8: RHEL-08-020352 ocil_clause: 'the above command returns no output, or if the umask is configured incorrectly' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml -index 44a426e2..c5371765 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chmod/rule.yml +index 07d37b18..10325371 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chmod/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chmod/rule.yml +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203 + stigid@ol7: OL07-00-030410 + stigid@rhel7: RHEL-07-030410 +- stigid@rhel8: RHEL-08-030490 ++ stigid@almalinux8: RHEL-08-030490 + stigid@sle12: SLES-12-020460 + stigid@sle15: SLES-15-030290 + stigid@ubuntu2004: UBTU-20-010152 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chown/rule.yml +index e2d9944a..37701323 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chown/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_chown/rule.yml +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219 + stigid@ol7: OL07-00-030370 + stigid@rhel7: RHEL-07-030370 +- stigid@rhel8: RHEL-08-030480 ++ stigid@almalinux8: RHEL-08-030480 + stigid@sle12: SLES-12-020420 + stigid@sle15: SLES-15-030250 + stigid@ubuntu2004: UBTU-20-010148 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml +index 6c3cc559..1c450020 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmod/rule.yml +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203 + stigid@ol7: OL07-00-030420 + stigid@rhel7: RHEL-07-030420 +- stigid@rhel8: RHEL-08-030540 ++ stigid@almalinux8: RHEL-08-030540 + stigid@sle12: SLES-12-020470 + stigid@sle15: SLES-15-030300 + stigid@ubuntu2004: UBTU-20-010153 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml +index 3e51d482..d9416b03 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchmodat/rule.yml +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203 + stigid@ol7: OL07-00-030430 + stigid@rhel7: RHEL-07-030430 +- stigid@rhel8: RHEL-08-030530 ++ stigid@almalinux8: RHEL-08-030530 + stigid@sle12: SLES-12-020480 + stigid@sle15: SLES-12-030310 + stigid@ubuntu2004: UBTU-20-010154 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml +index d89875fc..1d8cb96f 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchown/rule.yml +@@ -58,7 +58,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219 + stigid@ol7: OL07-00-030380 + stigid@rhel7: RHEL-07-030380 +- stigid@rhel8: RHEL-08-030520 ++ stigid@almalinux8: RHEL-08-030520 + stigid@sle12: SLES-12-020430 + stigid@sle15: SLES-15-030260 + stigid@ubuntu2004: UBTU-20-010149 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml +index e6caaeb5..c60ea30d 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fchownat/rule.yml +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219 + stigid@ol7: OL07-00-030400 + stigid@rhel7: RHEL-07-030400 +- stigid@rhel8: RHEL-08-030510 ++ stigid@almalinux8: RHEL-08-030510 + stigid@sle12: SLES-12-020450 + stigid@sle15: SLES-15-030280 + stigid@ubuntu2004: UBTU-20-010150 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml +index b9ad3c79..7efc9a2c 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fremovexattr/rule.yml +@@ -72,7 +72,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000466-GPOS-00210,SRG-OS-000064-GPOS-00033 + stigid@ol7: OL07-00-030480 + stigid@rhel7: RHEL-07-030480 +- stigid@rhel8: RHEL-08-030240 ++ stigid@almalinux8: RHEL-08-030240 + stigid@sle12: SLES-12-020410 + stigid@sle15: SLES-15-030210 + stigid@ubuntu2004: UBTU-20-010147 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml +index cedf05f9..ad793205 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_fsetxattr/rule.yml +@@ -67,7 +67,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000064-GPOS-00033 + stigid@ol7: OL07-00-030450 + stigid@rhel7: RHEL-07-030450 +- stigid@rhel8: RHEL-08-030230 ++ stigid@almalinux8: RHEL-08-030230 + stigid@sle12: SLES-12-020380 + stigid@sle15: SLES-15-030230 + stigid@ubuntu2004: UBTU-20-010144 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml +index 190509c0..578d214a 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lchown/rule.yml +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000466-GPOS-00210,SRG-OS-000458-GPOS-00203,SRG-OS-000474-GPOS-00219 + stigid@ol7: OL07-00-030390 + stigid@rhel7: RHEL-07-030390 +- stigid@rhel8: RHEL-08-030500 ++ stigid@almalinux8: RHEL-08-030500 + stigid@sle12: SLES-12-020440 + stigid@sle15: SLES-15-030270 + stigid@ubuntu2004: UBTU-20-010151 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lremovexattr/rule.yml +index ffdacdf0..394b26ef 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lremovexattr/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lremovexattr/rule.yml +@@ -72,7 +72,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000466-GPOS-00210,SRG-OS-000064-GPOS-00033 + stigid@ol7: OL07-00-030490 + stigid@rhel7: RHEL-07-030490 +- stigid@rhel8: RHEL-08-030200 ++ stigid@almalinux8: RHEL-08-030200 + stigid@sle12: SLES-12-020400 + stigid@sle15: SLES-15-030200 + stigid@ubuntu2004: UBTU-20-010146 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml +index 3662262f..f05f4d8e 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_lsetxattr/rule.yml +@@ -66,7 +66,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000064-GPOS-00033 + stigid@ol7: OL07-00-030460 + stigid@rhel7: RHEL-07-030460 +- stigid@rhel8: RHEL-08-030220 ++ stigid@almalinux8: RHEL-08-030220 + stigid@sle15: SLES-15-030240 + stigid@ubuntu2004: UBTU-20-010143 + vmmsrg: SRG-OS-000458-VMM-001810,SRG-OS-000474-VMM-001940 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml +index ac9d3492..45ecd956 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_removexattr/rule.yml +@@ -71,7 +71,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000458-GPOS-00203,SRG-OS-000462-GPOS-00206,SRG-OS-000463-GPOS-00207,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000474-GPOS-00219,SRG-OS-000466-GPOS-00210,SRG-OS-000064-GPOS-00033 + stigid@ol7: OL07-00-030470 + stigid@rhel7: RHEL-07-030470 +- stigid@rhel8: RHEL-08-030210 ++ stigid@almalinux8: RHEL-08-030210 + stigid@sle12: SLES-12-020390 + stigid@sle15: SLES-15-030190 + stigid@ubuntu2004: UBTU-20-010145 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml +index b661a1f9..b79ee03b 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_dac_actions/audit_rules_dac_modification_setxattr/rule.yml +@@ -67,7 +67,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203 + stigid@ol7: OL07-00-030440 + stigid@rhel7: RHEL-07-030440 +- stigid@rhel8: RHEL-08-030270 ++ stigid@almalinux8: RHEL-08-030270 + stigid@sle12: SLES-12-020370 + stigid@sle15: SLES-15-030220 + stigid@ubuntu2004: UBTU-20-010142 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_chacl/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_chacl/rule.yml +index 735817e4..5d6f6973 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_chacl/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_chacl/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: rhel8,sle12,sle15,ubuntu2004 ++prodtype: rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Record Any Attempts to Run chacl' + +@@ -35,7 +35,7 @@ references: + disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884 + nist@sle12: AU-3,AU-3.1,AU-12.1(ii),AU-12(a),AU-12.1(iv),AU-12(c),MA-4(1)(a) + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210 +- stigid@rhel8: RHEL-08-030570 ++ stigid@almalinux8: RHEL-08-030570 + stigid@sle12: SLES-12-020620 + stigid@sle15: SLES-15-030440 + stigid@ubuntu2004: UBTU-20-010168 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_setfacl/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_setfacl/rule.yml +index 341790d7..222c9853 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_setfacl/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_acl_commands/audit_rules_execution_setfacl/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8,sle12,sle15,ubuntu2004 ++prodtype: rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Record Any Attempts to Run setfacl' + +@@ -35,7 +35,7 @@ references: + disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884 + nist@sle12: AU-3,AU-3.1,AU-12.1(ii),AU-12(a),AU-12.1(iv),AU-12(c),MA-4(1)(a) + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 +- stigid@rhel8: RHEL-08-030330 ++ stigid@almalinux8: RHEL-08-030330 + stigid@sle12: SLES-12-020610 + stigid@sle15: SLES-15-030430 + stigid@ubuntu2004: UBTU-20-010167 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml +index 4a5f4337..86ef5b52 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_chcon/rule.yml +@@ -4,7 +4,7 @@ + + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Any Attempts to Run chcon' +@@ -59,7 +59,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209 + stigid@ol7: OL07-00-030580 + stigid@rhel7: RHEL-07-030580 +- stigid@rhel8: RHEL-08-030260 ++ stigid@almalinux8: RHEL-08-030260 + stigid@sle12: SLES-12-020630 + stigid@sle15: SLES-15-030450 + stigid@ubuntu2004: UBTU-20-010165 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_restorecon/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_restorecon/rule.yml -index 8c7b3996..94d82259 100644 +index eb913156..5c51715f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_restorecon/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_restorecon/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Any Attempts to Run restorecon' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_semanage/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_semanage/rule.yml -index 0b19258a..a437ca82 100644 +index a945ce16..4b88bd97 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_semanage/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_semanage/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Record Any Attempts to Run semanage' +@@ -56,7 +56,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209 + stigid@ol7: OL07-00-030560 + stigid@rhel7: RHEL-07-030560 +- stigid@rhel8: RHEL-08-030313 ++ stigid@almalinux8: RHEL-08-030313 + vmmsrg: SRG-OS-000463-VMM-001850 + + ocil: |- diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setfiles/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setfiles/rule.yml -index af2cdfee..3b42c21e 100644 +index 6db7d1da..e3a2f24a 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setfiles/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setfiles/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Any Attempts to Run setfiles' +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209 + stigid@ol7: OL07-00-030590 + stigid@rhel7: RHEL-07-030590 +- stigid@rhel8: RHEL-08-030314 ++ stigid@almalinux8: RHEL-08-030314 + vmmsrg: SRG-OS-000463-VMM-001850 + + ocil: |- diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setsebool/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setsebool/rule.yml -index 8fa73ac5..13614af5 100644 +index c357c48f..ef3ecb90 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setsebool/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_setsebool/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Record Any Attempts to Run setsebool' +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000463-GPOS-00207,SRG-OS-000465-GPOS-00209 + stigid@ol7: OL07-00-030570 + stigid@rhel7: RHEL-07-030570 +- stigid@rhel8: RHEL-08-030316 ++ stigid@almalinux8: RHEL-08-030316 + vmmsrg: SRG-OS-000463-VMM-001850 + + ocil: |- diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare/rule.yml -index 5b7be88b..e24454a7 100644 +index e317a2d5..0ee53626 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_execution_selinux_commands/audit_rules_execution_seunshare/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Any Attempts to Run seunshare' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/bash/shared.sh -index 02020a84..91843d9e 100644 +index 2b5e6649..5664dae0 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/bash/shared.sh +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/bash/shared.sh @@ -1,4 +1,4 @@ @@ -13948,356 +8142,433 @@ index 02020a84..91843d9e 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/rule.yml +index 1c9cf37d..f76ade39 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 + + title: 'Ensure auditd Collects File Deletion Events by User' + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rename/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rename/rule.yml +index 2f2d75a4..609151ec 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rename/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rename/rule.yml +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212 + stigid@ol7: OL07-00-030880 + stigid@rhel7: RHEL-07-030880 +- stigid@rhel8: RHEL-08-030361 ++ stigid@almalinux8: RHEL-08-030361 + stigid@ubuntu2004: UBTU-20-010269 + vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890 + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml +index 37620a38..ffb34db7 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_renameat/rule.yml +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212 + stigid@ol7: OL07-00-030890 + stigid@rhel7: RHEL-07-030890 +- stigid@rhel8: RHEL-08-030362 ++ stigid@almalinux8: RHEL-08-030362 + stigid@ubuntu2004: UBTU-20-010270 + vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890 + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml +index e6b40042..89cf23af 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_rmdir/rule.yml +@@ -47,7 +47,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212 + stigid@ol7: OL07-00-030900 + stigid@rhel7: RHEL-07-030900 +- stigid@rhel8: RHEL-08-030363 ++ stigid@almalinux8: RHEL-08-030363 + vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890 + + {{{ complete_ocil_entry_audit_syscall(syscall="rmdir") }}} +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml +index bfe53b7d..d6a1340b 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlink/rule.yml +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212 + stigid@ol7: OL07-00-030910 + stigid@rhel7: RHEL-07-030910 +- stigid@rhel8: RHEL-08-030364 ++ stigid@almalinux8: RHEL-08-030364 + stigid@ubuntu2004: UBTU-20-010267 + vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890 + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml +index bd246f1b..ea4b92b3 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_deletion_events/audit_rules_file_deletion_events_unlinkat/rule.yml +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210,SRG-OS-000467-GPOS-00211,SRG-OS-000468-GPOS-00212 + stigid@ol7: OL07-00-030920 + stigid@rhel7: RHEL-07-030920 +- stigid@rhel8: RHEL-08-030365 ++ stigid@almalinux8: RHEL-08-030365 + stigid@ubuntu2004: UBTU-20-010268 + vmmsrg: SRG-OS-000466-VMM-001870,SRG-OS-000468-VMM-001890 + diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chmod/rule.yml -index dd2c1a12..0750d698 100644 +index d3b01863..2bb5eb1b 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chmod/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chmod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Record Successful Permission Changes to Files - chmod' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chown/rule.yml -index 5aa12773..a280bd31 100644 +index 241d1d63..f9749a32 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_chown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Ownership Changes to Files - chown' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_creat/rule.yml -index ef1bd04b..a7f05515 100644 +index a1f8f395..173d16fb 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Access Attempts to Files - creat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmod/rule.yml -index 8a809c65..85b4ef25 100644 +index ce7070ed..8fdaba2d 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmod/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - fchmod' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmodat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmodat/rule.yml -index fbe2a248..055fcdb9 100644 +index 4b6cee01..3f60a691 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmodat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchmodat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - fchmodat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchown/rule.yml -index 4de26ca4..2404fbe8 100644 +index 6bc0b959..71a0383b 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Ownership Changes to Files - fchown' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchownat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchownat/rule.yml -index 35b0ab9d..6fbb2b6c 100644 +index e882a57b..ef4a46a9 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchownat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fchownat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Ownership Changes to Files - fchownat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fremovexattr/rule.yml -index a9192fae..3af73f7c 100644 +index ee4ff3a8..9aaea3ee 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fremovexattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fremovexattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - fremovexattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fsetxattr/rule.yml -index f158bf7d..d8b3076b 100644 +index d40bfdee..8ce3cb3a 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fsetxattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_fsetxattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - fsetxattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_ftruncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_ftruncate/rule.yml -index e02f99b6..d329e633 100644 +index 4fe00220..d99a82aa 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_ftruncate/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_ftruncate/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Access Attempts to Files - ftruncate' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lchown/rule.yml -index 79b0a707..67dcca93 100644 +index 90873b10..2e82232c 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lchown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lchown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Ownership Changes to Files - lchown' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lremovexattr/rule.yml -index 19d2e35e..bb30374a 100644 +index acbfbc0e..dfdcfbad 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lremovexattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lremovexattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - lremovexattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lsetxattr/rule.yml -index 22b5164d..6dc89c31 100644 +index b669f750..9897c41b 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lsetxattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_lsetxattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - lsetxattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open/rule.yml -index e2e526cf..f44065c6 100644 +index 9cc9ff86..3de02e18 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Access Attempts to Files - open' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at/rule.yml -index bcf48d59..828ce94d 100644 +index 89a65e14..bc586252 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Access Attempts to Files - open_by_handle_at' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_creat/rule.yml -index 4285ce7d..c7d0bfdf 100644 +index 38a00312..ad07bfd0 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Record Successful Creation Attempts to Files - open_by_handle_at O_CREAT' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write/rule.yml -index 8173344c..84002135 100644 +index 5ed132a5..0352431c 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_by_handle_at_o_trunc_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Record Successful Creation Attempts to Files - open_by_handle_at O_TRUNC_WRITE' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_creat/rule.yml -index 8c902371..fae66975 100644 +index bef2d87a..ac4e2ebe 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Record Successful Creation Attempts to Files - open O_CREAT' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_trunc_write/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_trunc_write/rule.yml -index 701b7964..e6d3299a 100644 +index 653e1d8e..d6cf93b7 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_trunc_write/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_open_o_trunc_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Record Successful Creation Attempts to Files - open O_TRUNC_WRITE' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat/rule.yml -index 032c3ebd..76356871 100644 +index 16e9b483..7ede712e 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Access Attempts to Files - openat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_creat/rule.yml -index 2b9a474c..ab46b768 100644 +index 75ead44a..1d342e48 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Record Successful Creation Attempts to Files - openat O_CREAT' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_trunc_write/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_trunc_write/rule.yml -index 8382764c..5e8acd00 100644 +index 13ff5e23..11279f4b 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_trunc_write/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_openat_o_trunc_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Record Successful Creation Attempts to Files - openat O_TRUNC_WRITE' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_removexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_removexattr/rule.yml -index 61cb9be1..06bdb1b8 100644 +index 7d7e3ebe..6e115c37 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_removexattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_removexattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - removexattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_rename/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_rename/rule.yml -index 142bf75d..fad7a325 100644 +index 82d103ec..84fa9b87 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_rename/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_rename/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Delete Attempts to Files - rename' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_renameat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_renameat/rule.yml -index c2ab4174..0e6a0b25 100644 +index 1736c971..046a17f3 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_renameat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_renameat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Delete Attempts to Files - renameat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_setxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_setxattr/rule.yml -index 7e737d6a..60e0aee8 100644 +index 75809f4a..852c7f93 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_setxattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_setxattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Permission Changes to Files - setxattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_truncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_truncate/rule.yml -index 43622f29..7e68156e 100644 +index 4d850dc8..c1a49a4f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_truncate/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_truncate/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Access Attempts to Files - truncate' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlink/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlink/rule.yml -index b3c54bf8..71859490 100644 +index 91e8f67b..0c57eabc 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlink/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlink/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Delete Attempts to Files - unlink' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlinkat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlinkat/rule.yml -index a2110080..47ac027d 100644 +index a11b195b..3e87d37f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlinkat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_successful_file_modification_unlinkat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Record Successful Delete Attempts to Files - unlinkat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/bash/shared.sh -index cdde2eab..22c19a72 100644 +index 5cb4dbe6..f88cd458 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/bash/shared.sh +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/bash/shared.sh @@ -1,4 +1,4 @@ @@ -14306,206 +8577,234 @@ index cdde2eab..22c19a72 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/rule.yml +index e2ff8a02..f106a17b 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 + + title: 'Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)' + diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chmod/rule.yml -index bb91b766..68786f71 100644 +index ddfe1e9d..ec62165d 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chmod/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chmod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - chmod' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chown/rule.yml -index 3f0b1b53..c5549e59 100644 +index 6ca6e27b..bb624b8f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_chown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Ownership Changes to Files - chown' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml -index b5abef23..861f7c76 100644 +index 5c751cb2..14cf1b53 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Unsuccessful Access Attempts to Files - creat' +@@ -60,7 +60,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205 + stigid@ol7: OL07-00-030500 + stigid@rhel7: RHEL-07-030500 +- stigid@rhel8: RHEL-08-030470 ++ stigid@almalinux8: RHEL-08-030470 + stigid@sle12: SLES-12-020520 + stigid@sle15: SLES-15-030160 + stigid@ubuntu2004: UBTU-20-010158 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmod/rule.yml -index 1acb1346..2cc78347 100644 +index 1a93b453..170e0027 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmod/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - fchmod' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmodat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmodat/rule.yml -index 2bf620b4..0d7cbc58 100644 +index dd77cd60..bc79016c 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmodat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchmodat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - fchmodat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchown/rule.yml -index 278b34c9..a315e213 100644 +index 3e5da890..6e55b2a9 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Ownership Changes to Files - fchown' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchownat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchownat/rule.yml -index 15257c5f..1c471bbe 100644 +index 76f0e177..016e13c9 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchownat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fchownat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Ownership Changes to Files - fchownat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fremovexattr/rule.yml -index 9914de51..c7606a6f 100644 +index a6fbb185..c1455d6c 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fremovexattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fremovexattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - fremovexattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fsetxattr/rule.yml -index 44f00715..25dc43bd 100644 +index bf1ff867..ac79f42c 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fsetxattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_fsetxattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - fsetxattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml -index 9ed6b366..c8bc1441 100644 +index 76bcea15..f5cf3e82 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_ftruncate/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Unsuccessful Access Attempts to Files - ftruncate' +@@ -63,7 +63,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205 + stigid@ol7: OL07-00-030550 + stigid@rhel7: RHEL-07-030550 +- stigid@rhel8: RHEL-08-030460 ++ stigid@almalinux8: RHEL-08-030460 + stigid@sle12: SLES-12-020510 + stigid@sle15: SLES-15-030320 + stigid@ubuntu2004: UBTU-20-010157 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lchown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lchown/rule.yml -index 884939d4..d0ebe1ce 100644 +index 3d42cea2..d6d0f45e 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lchown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lchown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Ownership Changes to Files - lchown' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lremovexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lremovexattr/rule.yml -index 0a99fff5..799f7b25 100644 +index 05c1f7c8..a464da9f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lremovexattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lremovexattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - lremovexattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lsetxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lsetxattr/rule.yml -index bed13e9f..9bfbb5f6 100644 +index e388ec2d..314b64f7 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lsetxattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_lsetxattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - lsetxattr' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/bash/shared.sh -index c93a8d88..5d2171bb 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux -+# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux - # - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml -index 97aa7710..506f6ee1 100644 +index 7c6764d2..28974844 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Unsuccessful Access Attempts to Files - open' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/bash/shared.sh -index c93a8d88..5d2171bb 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux -+# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux - # - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions +@@ -63,7 +63,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205 + stigid@ol7: OL07-00-030510 + stigid@rhel7: RHEL-07-030510 +- stigid@rhel8: RHEL-08-030440 ++ stigid@almalinux8: RHEL-08-030440 + stigid@sle12: SLES-12-020490 + stigid@sle15: SLES-15-030150 + stigid@ubuntu2004: UBTU-20-010155 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml -index 28076744..ab83abfa 100644 +index 9bb5ffe3..706edf61 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Unsuccessful Access Attempts to Files - open_by_handle_at' +@@ -59,7 +59,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205 + stigid@ol7: OL07-00-030530 + stigid@rhel7: RHEL-07-030530 +- stigid@rhel8: RHEL-08-030450 ++ stigid@almalinux8: RHEL-08-030450 + stigid@sle12: SLES-12-020540 + stigid@sle15: SLES-15-030180 + stigid@ubuntu2004: UBTU-20-010160 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/bash/shared.sh index c93a8d88..5d2171bb 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/bash/shared.sh @@ -14517,14 +8816,14 @@ index c93a8d88..5d2171bb 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/rule.yml -index 9ee9f9fe..f0cff2b5 100644 +index dbca575d..f00a0ff9 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessful Creation Attempts to Files - open_by_handle_at O_CREAT' @@ -14539,14 +8838,14 @@ index c93a8d88..5d2171bb 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write/rule.yml -index 3460a48f..802f933f 100644 +index b3a06000..462ad0a1 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_o_trunc_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessful Modification Attempts to Files - open_by_handle_at O_TRUNC_WRITE' @@ -14561,14 +8860,14 @@ index 282e673c..b7c5f1bf 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order/rule.yml -index 30cb64b4..023810b7 100644 +index 650f5b6d..7104f6cd 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_by_handle_at_rule_order/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure auditd Unauthorized Access Attempts To open_by_handle_at Are Ordered Correctly' @@ -14583,14 +8882,14 @@ index 1e021c4f..41533c52 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat/rule.yml -index a7819c14..06e23536 100644 +index e0d4117e..222d70c8 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessful Creation Attempts to Files - open O_CREAT' @@ -14605,14 +8904,14 @@ index 1e021c4f..41533c52 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write/rule.yml -index ec871cf6..39572f4c 100644 +index 1cc53b18..2d82f928 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_o_trunc_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessful Modification Attempts to Files - open O_TRUNC_WRITE' @@ -14627,39 +8926,38 @@ index 282e673c..b7c5f1bf 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order/rule.yml -index 02ffe9ae..1b7bb790 100644 +index 34e5d448..7d6ab8dc 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_open_rule_order/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure auditd Rules For Unauthorized Attempts To open Are Ordered Correctly' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/bash/shared.sh -index 1e021c4f..41533c52 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel -+# platform = Red Hat Virtualization 4,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux - # - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml -index f1699ab1..47e291c6 100644 +index c99656cc..5a0651b2 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Unsuccessful Access Attempts to Files - openat' +@@ -63,7 +63,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205 + stigid@ol7: OL07-00-030520 + stigid@rhel7: RHEL-07-030520 +- stigid@rhel8: RHEL-08-030430 ++ stigid@almalinux8: RHEL-08-030430 + stigid@sle12: SLES-12-020530 + stigid@sle15: SLES-15-030170 + stigid@ubuntu2004: UBTU-20-010159 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/bash/shared.sh index 1e021c4f..41533c52 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/bash/shared.sh @@ -14671,14 +8969,14 @@ index 1e021c4f..41533c52 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/rule.yml -index 9cfb3289..fb59192b 100644 +index b66f7225..e6c6c787 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_creat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessful Creation Attempts to Files - openat O_CREAT' @@ -14693,14 +8991,14 @@ index 1e021c4f..41533c52 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write/rule.yml -index 2ed974e4..c8a29eee 100644 +index bf575128..4081e603 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_o_trunc_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessful Modification Attempts to Files - openat O_TRUNC_WRITE' @@ -14715,103 +9013,112 @@ index 282e673c..b7c5f1bf 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_rule_order/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_rule_order/rule.yml -index ea7291c1..196bf05c 100644 +index 4a09bc68..40f06aae 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_rule_order/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_openat_rule_order/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure auditd Rules For Unauthorized Attempts To openat Are Ordered Correctly' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_removexattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_removexattr/rule.yml -index 531676d4..376e50b9 100644 +index b16b964d..f5d1c1ea 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_removexattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_removexattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - removexattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_rename/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_rename/rule.yml -index a85dd692..2da9de2c 100644 +index ae390fc9..bc2c87f4 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_rename/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_rename/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Record Unsuccessul Delete Attempts to Files - rename' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_renameat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_renameat/rule.yml -index 87a7ec0b..60473ee1 100644 +index ab5d3b8d..a943e75f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_renameat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_renameat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Record Unsuccessul Delete Attempts to Files - renameat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_setxattr/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_setxattr/rule.yml -index 7dae6259..30f86107 100644 +index a45d0cda..69fc6720 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_setxattr/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_setxattr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Unsuccessul Permission Changes to Files - setxattr' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml -index 60d98c58..59cf3a46 100644 +index 12771beb..fc214ad6 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_truncate/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Unsuccessful Access Attempts to Files - truncate' +@@ -62,7 +62,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000064-GPOS-00033,SRG-OS-000458-GPOS-00203,SRG-OS-000461-GPOS-00205 + stigid@ol7: OL07-00-030540 + stigid@rhel7: RHEL-07-030540 +- stigid@rhel8: RHEL-08-030420 ++ stigid@almalinux8: RHEL-08-030420 + stigid@sle12: SLES-12-020500 + stigid@sle15: SLES-15-030610 + stigid@ubuntu2004: UBTU-20-010156 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlink/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlink/rule.yml -index 43e94bd3..9a766b2b 100644 +index c78957ba..97e31b51 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlink/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlink/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Record Unsuccessul Delete Attempts to Files - unlink' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlinkat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlinkat/rule.yml -index be69e8eb..468f90c3 100644 +index 8fa62518..b5bc00b2 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlinkat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_file_modification/audit_rules_unsuccessful_file_modification_unlinkat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Record Unsuccessul Delete Attempts to Files - unlinkat' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/ansible/shared.yml -index 8421076f..69186715 100644 +index 905c14fe..fb7f6cff 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -14820,50 +9127,62 @@ index 8421076f..69186715 100644 # reboot = true # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/bash/shared.sh -index 9e61ec32..dbfeb520 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_ol +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/rule.yml +index 55246da9..20b1a3ea 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 + + title: 'Ensure auditd Collects Information on Kernel Module Loading and Unloading' - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/ansible/shared.yml -index c7b605ec..1ef6d296 100644 +index f5469c0e..6caf0ab7 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_rhv,multi_platform_sle -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle +-# platform = multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle,multi_platform_ol # reboot = false # complexity = low # disruption = low -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/bash/shared.sh -index 9d921825..ece31ef5 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv - - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/kubernetes/shared.yml +index 51a61028..71df13a4 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + apiVersion: machineconfiguration.openshift.io/v1 + kind: MachineConfig + spec: diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml -index 0997c1c6..fdf2f877 100644 +index 052d21b4..584c6a3e 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_delete/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on Kernel Module Unloading - delete_module' +@@ -51,7 +51,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000477-GPOS-00222 + stigid@ol7: OL07-00-030830 + stigid@rhel7: RHEL-07-030830 +- stigid@rhel8: RHEL-08-030390 ++ stigid@almalinux8: RHEL-08-030390 + stigid@sle12: SLES-12-020730 + stigid@sle15: SLES-15-030520 + stigid@ubuntu2004: UBTU-20-010302 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/ansible/shared.yml -index 3f3c3e3d..73a821c6 100644 +index 2e0780af..2ecb0742 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -14872,60 +9191,80 @@ index 3f3c3e3d..73a821c6 100644 # reboot = false # complexity = low # disruption = low -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/bash/shared.sh -index 17769226..d3c274e9 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv - - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/kubernetes/shared.yml +index 90d7d43d..818c3cad 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + apiVersion: machineconfiguration.openshift.io/v1 + kind: MachineConfig + spec: diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml -index f54035bf..69a01414 100644 +index aa170023..bb9ee295 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_finit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on Kernel Module Loading and Unloading - finit_module' +@@ -50,7 +50,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000477-GPOS-00222 + stigid@ol7: OL07-00-030821 + stigid@rhel7: RHEL-07-030821 +- stigid@rhel8: RHEL-08-030380 ++ stigid@almalinux8: RHEL-08-030380 + stigid@sle12: SLES-12-020740 + stigid@sle15: SLES-15-030530 + stigid@ubuntu2004: UBTU-20-010180 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/ansible/shared.yml -index d804bbd0..30298f70 100644 +index 6f6bd182..d20223bf 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_rhv,multi_platform_sle -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle +-# platform = multi_platform_rhel,multi_platform_rhv,multi_platform_sle,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle,multi_platform_ol # reboot = false # complexity = low # disruption = low -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/bash/shared.sh -index 3ae972e4..f34ff904 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv - - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/kubernetes/shared.yml +index 2fb9a7ff..7cef862d 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + apiVersion: machineconfiguration.openshift.io/v1 + kind: MachineConfig + spec: diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml -index 829f3b2c..c3dde7b1 100644 +index 1d826043..26eebc3d 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_kernel_module_loading/audit_rules_kernel_module_loading_init/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on Kernel Module Loading - init_module' +@@ -50,7 +50,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000477-GPOS-00222 + stigid@ol7: OL07-00-030820 + stigid@rhel7: RHEL-07-030820 +- stigid@rhel8: RHEL-08-030360 ++ stigid@almalinux8: RHEL-08-030360 + stigid@sle12: SLES-12-020750 + stigid@sle15: SLES-15-030540 + stigid@ubuntu2004: UBTU-20-010179 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/bash/shared.sh index 9c86d272..3e329261 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/bash/shared.sh @@ -14936,53 +9275,65 @@ index 9c86d272..3e329261 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/rule.yml +index c062cf52..9c29b4e1 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 + + title: 'Record Attempts to Alter Logon and Logout Events' + diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml -index 3cdacb5f..c61e6dac 100644 +index 94d044ff..593a6d56 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Record Attempts to Alter Logon and Logout Events - faillock' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml -index 1d8a6f72..1eb76d0b 100644 +index 25f578b1..cc309bec 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Attempts to Alter Logon and Logout Events - lastlog' -@@ -50,7 +50,7 @@ references: - cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,APO13.01,BAI03.05,BAI08.02,DSS01.03,DSS01.04,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS03.05,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01 - iso27001-2013: A.11.2.6,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.7,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.2.1,A.6.2.2 - cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8,9 +@@ -51,7 +51,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000473-GPOS-00218,SRG-OS-000470-GPOS-00214 + stigid@ol7: OL07-00-030620 + stigid@rhel7: RHEL-07-030620 - stigid@rhel8: RHEL-08-030600 + stigid@almalinux8: RHEL-08-030600 - - ocil_clause: 'there is not output' - + stigid@sle12: SLES-12-020660 + stigid@sle15: SLES-15-030480 + stigid@ubuntu2004: UBTU-20-010171 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_tallylog/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_tallylog/rule.yml -index 730b7d72..81c50692 100644 +index 0da92228..441f051e 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_tallylog/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_tallylog/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Attempts to Alter Logon and Logout Events - tallylog' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml -index 2b019243..cdbc3b52 100644 +index 850b4b1b..89815499 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -15180,415 +9531,720 @@ index 3a947ea1..8471b399 100644 ./generate_privileged_commands_rule.sh 1000 own_key /etc/audit/rules.d/privileged.rules diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at/rule.yml -index 6639d956..042cd757 100644 +index c6464dbf..2961fb6d 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_at/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - at' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chage/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chage/rule.yml -index 0fcf3fb9..3b190421 100644 +index b5a9e29d..0f3b5781 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chage/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chage/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - chage' +@@ -58,7 +58,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000468-GPOS-00212,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030660 + stigid@rhel7: RHEL-07-030660 +- stigid@rhel8: RHEL-08-030250 ++ stigid@almalinux8: RHEL-08-030250 + stigid@sle12: SLES-12-020690 + stigid@sle15: SLES-15-030120 + stigid@ubuntu2004: UBTU-20-010175 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chsh/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chsh/rule.yml -index 62990d16..bd5affed 100644 +index 8cc2b236..d97ac264 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chsh/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_chsh/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - chsh' +@@ -58,7 +58,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030720 + stigid@rhel7: RHEL-07-030720 +- stigid@rhel8: RHEL-08-030410 ++ stigid@almalinux8: RHEL-08-030410 + stigid@sle12: SLES-12-020580 + stigid@sle15: SLES-15-030100 + stigid@ubuntu2004: UBTU-20-010163 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_crontab/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_crontab/rule.yml -index 0cd92027..61bd9457 100644 +index 86633fb6..c9994260 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_crontab/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_crontab/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - crontab' +@@ -57,7 +57,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030800 + stigid@rhel7: RHEL-07-030800 +- stigid@rhel8: RHEL-08-030400 ++ stigid@almalinux8: RHEL-08-030400 + stigid@sle12: SLES-12-020710 + stigid@sle15: SLES-15-030130 + stigid@ubuntu2004: UBTU-20-010177 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml -index 48d3c6c7..89185c9f 100644 +index ac5bfb2c..fc55348f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_gpasswd/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - gpasswd' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml -index 4941b38a..ddcc0c2a 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml -@@ -1,6 +1,6 @@ +@@ -59,7 +59,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030650 + stigid@rhel7: RHEL-07-030650 +- stigid@rhel8: RHEL-08-030370 ++ stigid@almalinux8: RHEL-08-030370 + stigid@sle12: SLES-12-020560 + stigid@sle15: SLES-15-030080 + stigid@ubuntu2004: UBTU-20-010174 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/ansible/shared.yml +index 5baa999e..cb49a4d7 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/ansible/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/bash/shared.sh +index 8e4fa636..04619986 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/bash/shared.sh ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_insmod/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + + # Include source function library. + . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_kmod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_kmod/rule.yml +index b469e42b..ad89b5f9 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_kmod/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_kmod/rule.yml +@@ -8,7 +8,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,sle12 +-prodtype: rhel8,sle12,sle15,ubuntu2004 ++prodtype: rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Ensure auditd Collects Information on the Use of Privileged Commands - kmod' + +@@ -44,7 +44,7 @@ references: + disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884 + nist: AU-3,AU-3.1,AU-12(a),AU-12.1(ii),AU-12.1(iv)AU-12(c),MA-4(1)(a) + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000471-GPOS-00216,SRG-OS-000477-GPOS-00222 +- stigid@rhel8: RHEL-08-030580 ++ stigid@almalinux8: RHEL-08-030580 + stigid@sle12: SLES-12-020360 + stigid@sle15: SLES-15-030410 + stigid@ubuntu2004: UBTU-20-010297 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/ansible/shared.yml +index 8f61ee32..07ddf429 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/ansible/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/bash/shared.sh +index 59ebc0fd..f0cc57e1 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/bash/shared.sh ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_modprobe/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + + # Include source function library. + . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml +index 56bd72b6..ee8f032c 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_mount/rule.yml +@@ -4,7 +4,7 @@ + + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle12,sle15,ubuntu2004 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - mount' +@@ -50,7 +50,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030740 + stigid@rhel7: RHEL-07-030740 +- stigid@rhel8: RHEL-08-030300 ++ stigid@almalinux8: RHEL-08-030300 + stigid@sle12: SLES-12-020290 + stigid@sle15: SLES-15-030350 + stigid@ubuntu2004: UBTU-20-010138 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap/rule.yml -index efc78bef..20bee456 100644 +index f636e162..2f9498cf 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgidmap/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newgidmap' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgrp/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgrp/rule.yml -index 462dda8b..aed6b69c 100644 +index 4c14ea50..b841a3fa 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgrp/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newgrp/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newgrp' +@@ -59,7 +59,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030710 + stigid@rhel7: RHEL-07-030710 +- stigid@rhel8: RHEL-08-030350 ++ stigid@almalinux8: RHEL-08-030350 + stigid@sle12: SLES-12-020570 + stigid@sle15: SLES-15-030090 + stigid@ubuntu2004: UBTU-20-010164 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap/rule.yml -index 03658656..552996e1 100644 +index d75f2051..696b4e0e 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_newuidmap/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - newuidmap' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pam_timestamp_check/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pam_timestamp_check/rule.yml -index d6780b01..defb06db 100644 +index c34eeb54..dc4ec5dd 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pam_timestamp_check/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pam_timestamp_check/rule.yml -@@ -1,6 +1,6 @@ +@@ -11,7 +11,7 @@ + documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - pam_timestamp_check' +@@ -65,7 +65,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030810 + stigid@rhel7: RHEL-07-030810 +- stigid@rhel8: RHEL-08-030340 ++ stigid@almalinux8: RHEL-08-030340 + stigid@sle12: SLES-12-020720 + stigid@sle15: SLES-15-030510 + stigid@ubuntu2004: UBTU-20-010178 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml -index 9323934f..10312df2 100644 +index 2af86f50..7cb88891 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_passwd/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - passwd' +@@ -58,7 +58,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030630 + stigid@rhel7: RHEL-07-030630 +- stigid@rhel8: RHEL-08-030290 ++ stigid@almalinux8: RHEL-08-030290 + stigid@sle12: SLES-12-020550 + stigid@sle15: SLES-15-030070 + stigid@ubuntu2004: UBTU-20-010172 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postdrop/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postdrop/rule.yml -index e115387b..aa85dc90 100644 +index 9509216e..859a508e 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postdrop/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postdrop/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - postdrop' +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030760 + stigid@rhel7: RHEL-07-030760 +- stigid@rhel8: RHEL-08-030311 ++ stigid@almalinux8: RHEL-08-030311 + vmmsrg: SRG-OS-000471-VMM-001910 + + ocil_clause: 'it is not the case' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postqueue/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postqueue/rule.yml -index 5759f71d..2ad329d6 100644 +index c5d1a82c..95d5f841 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postqueue/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_postqueue/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - postqueue' +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030770 + stigid@rhel7: RHEL-07-030770 +- stigid@rhel8: RHEL-08-030312 ++ stigid@almalinux8: RHEL-08-030312 + vmmsrg: SRG-OS-000471-VMM-001910 + + ocil_clause: 'it is not the case' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pt_chown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pt_chown/rule.yml -index 1cb56746..a645a4e5 100644 +index cb5995c1..7dbcaa68 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pt_chown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_pt_chown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - pt_chown' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml -index c29b6f82..e5a37cc8 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/ansible/shared.yml +index f3c3324e..d5545d32 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/ansible/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/bash/shared.sh +index 699b21f9..c16036a3 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/bash/shared.sh ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_rmmod/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + + # Include source function library. + . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_agent/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_agent/rule.yml +index f2ebca45..113b4c55 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_agent/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_agent/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: rhel8,sle12,sle15,ubuntu2004 ++prodtype: rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Record Any Attempts to Run ssh-agent' + +@@ -37,7 +37,7 @@ references: + disa: CCI-000130,CCI-000169,CCI-000172 + nist@sle12: AU-3,AU-3.1,AU-12(a),AU-12(c),AU-12.1(a),AU-12.1(ii),AU-12.1(iv),MA-4(1)(a) + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 +- stigid@rhel8: RHEL-08-030280 ++ stigid@almalinux8: RHEL-08-030280 + stigid@sle12: SLES-12-020310 + stigid@sle15: SLES-15-030370 + stigid@ubuntu2004: UBTU-20-010140 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml +index 604cbcda..4ad6e2ad 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_ssh_keysign/rule.yml +@@ -10,7 +10,7 @@ + + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign' +@@ -64,7 +64,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030780 + stigid@rhel7: RHEL-07-030780 +- stigid@rhel8: RHEL-08-030320 ++ stigid@almalinux8: RHEL-08-030320 + stigid@sle12: SLES-12-020320 + stigid@sle15: SLES-15-030060 + stigid@ubuntu2004: UBTU-20-010141 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml -index 86c423dd..d17c346b 100644 +index 87a81ee0..1177a271 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_su/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - su' +@@ -58,7 +58,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000064-GPOS-0003,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210 + stigid@ol7: OL07-00-030680 + stigid@rhel7: RHEL-07-030680 +- stigid@rhel8: RHEL-08-030190 ++ stigid@almalinux8: RHEL-08-030190 + stigid@sle12: SLES-12-020250 + stigid@sle15: SLES-15-030550 + stigid@ubuntu2004: UBTU-20-010136 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml -index 9e9e8927..edadb991 100644 +index e9890918..e533bfed 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudo/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - sudo' +@@ -59,7 +59,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210 + stigid@ol7: OL07-00-030690 + stigid@rhel7: RHEL-07-030690 +- stigid@rhel8: RHEL-08-030550 ++ stigid@almalinux8: RHEL-08-030550 + stigid@sle12: SLES-12-020260 + stigid@sle15: SLES-15-030560 + stigid@ubuntu2004: UBTU-20-010161 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml -index 56be0777..1c3f6bbe 100644 +index b65afabb..c6b62ef0 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_sudoedit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - sudoedit' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_umount/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_umount/rule.yml -index 2ce9d62a..2761d8c7 100644 +index 5d47508b..71f9546c 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_umount/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_umount/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - umount' +@@ -58,7 +58,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030750 + stigid@rhel7: RHEL-07-030750 +- stigid@rhel8: RHEL-08-030301 ++ stigid@almalinux8: RHEL-08-030301 + stigid@sle12: SLES-12-020300 + stigid@sle15: SLES-15-030360 + stigid@ubuntu2004: UBTU-20-010139 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_chkpwd/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_chkpwd/rule.yml -index b458ed6d..3e1aa24d 100644 +index 5be7f486..459617f7 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_chkpwd/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_chkpwd/rule.yml -@@ -1,6 +1,6 @@ +@@ -4,7 +4,7 @@ + documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - unix_chkpwd' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml -index 08c4df82..e815a6ec 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml +@@ -59,7 +59,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030640 + stigid@rhel7: RHEL-07-030640 +- stigid@rhel8: RHEL-08-030317 ++ stigid@almalinux8: RHEL-08-030317 + stigid@sle12: SLES-12-020680 + stigid@sle15: SLES-15-030110 + vmmsrg: SRG-OS-000471-VMM-001910 +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_update/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_update/rule.yml +index 7ef800da..d645e83c 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_update/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_unix_update/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel8,rhel9 ++prodtype: rhel8,almalinux8,rhel9 + + title: 'Ensure auditd Collects Information on the Use of Privileged Commands - unix_update' + +@@ -37,7 +37,7 @@ identifiers: + references: + disa: CCI-000169 + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 +- stigid@rhel8: RHEL-08-030310 ++ stigid@almalinux8: RHEL-08-030310 + + ocil_clause: 'it is not the case' + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml +index 6dccc806..11e8adad 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_userhelper/rule.yml +@@ -4,7 +4,7 @@ + + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - userhelper' +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030670 + stigid@rhel7: RHEL-07-030670 +- stigid@rhel8: RHEL-08-030315 ++ stigid@almalinux8: RHEL-08-030315 + vmmsrg: SRG-OS-000471-VMM-001910 + + ocil_clause: 'it is not the case' +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usermod/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usermod/rule.yml +index 70890161..bfc61715 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usermod/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usermod/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8,sle12,sle15,ubuntu2004 ++prodtype: rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Ensure auditd Collects Information on the Use of Privileged Commands - usermod' + +@@ -39,7 +39,7 @@ references: + disa: CCI-000130,CCI-000169,CCI-000172,CCI-002884 + nist@sle12: AU-3,AU-12(a),AU-12(c),MA-4(1)(a) + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000466-GPOS-00210 +- stigid@rhel8: RHEL-08-030560 ++ stigid@almalinux8: RHEL-08-030560 + stigid@sle12: SLES-12-020700 + stigid@sle15: SLES-15-030500 + stigid@ubuntu2004: UBTU-20-010176 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl/rule.yml -index 43146e6d..db7ead20 100644 +index 82aee103..b3f858f6 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_privileged_commands/audit_rules_privileged_commands_usernetctl/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure auditd Collects Information on the Use of Privileged Commands - usernetctl' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open/rule.yml -index 25c2bed0..44330b44 100644 +index 1624800e..4779206a 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open syscall - /etc/group' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open_by_handle_at/rule.yml -index d8c8cfb0..700a45b7 100644 +index 40a4dbe1..c2bd2b96 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open_by_handle_at/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_open_by_handle_at/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/group' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_openat/rule.yml -index 29dd8a7c..8920c283 100644 +index 9fc74c8d..eaf19da7 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_openat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_group_openat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via openat syscall - /etc/group' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open/rule.yml -index 3e3e5f52..2960ea56 100644 +index 6d8b3825..48d2733e 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open syscall - /etc/gshadow' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open_by_handle_at/rule.yml -index b2425c18..72f7854f 100644 +index 193ba904..f8cfe822 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open_by_handle_at/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_open_by_handle_at/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/gshadow' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_openat/rule.yml -index 6e3096d7..ff293488 100644 +index b4c62c06..80570cd3 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_openat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_gshadow_openat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via openat syscall - /etc/gshadow' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open/rule.yml -index 4b19927a..6c83ab16 100644 +index 5a2720c7..ae278d24 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open syscall - /etc/passwd' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open_by_handle_at/rule.yml -index aaf829f6..ff1f665f 100644 +index ffbc6bb7..ed4ab674 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open_by_handle_at/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_open_by_handle_at/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/passwd' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_openat/rule.yml -index 35dd183d..4b453e37 100644 +index 82f30df8..2c22c45d 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_openat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_passwd_openat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via openat syscall - /etc/passwd' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open/rule.yml -index 1c724193..db1987b7 100644 +index 1f108ace..35527d88 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open syscall - /etc/shadow' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open_by_handle_at/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open_by_handle_at/rule.yml -index e3c77b16..217cc372 100644 +index 524503c7..2b263578 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open_by_handle_at/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_open_by_handle_at/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via open_by_handle_at syscall - /etc/shadow' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_openat/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_openat/rule.yml -index ae784911..805035c9 100644 +index cf135641..ff19970a 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_openat/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_etc_shadow_openat/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Record Events that Modify User/Group Information via openat syscall - /etc/shadow' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh -index 29cd4a5d..c38b0e28 100644 +index 36e06914..1e43efa0 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/bash/shared.sh @@ -1,4 +1,4 @@ @@ -15597,17 +10253,27 @@ index 29cd4a5d..c38b0e28 100644 # Traverse all of: # +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/kubernetes/shared.yml +index 26d02c24..28daa910 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + apiVersion: machineconfiguration.openshift.io/v1 + kind: MachineConfig + spec: diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/rule.yml -index 1f563ae0..74e814d3 100644 +index 6818e5c7..74f4a76a 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_immutable/rule.yml -@@ -42,5 +42,5 @@ references: - cobit5: APO01.06,APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8 +@@ -48,4 +48,4 @@ references: + nist-csf: DE.AE-3,DE.AE-5,ID.SC-4,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4 + pcidss: Req-10.5.2 + srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029 - stigid@rhel8: RHEL-08-030121 + stigid@almalinux8: RHEL-08-030121 - diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/ansible/shared.yml index 4633be5a..cb5dd0dc 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/ansible/shared.yml @@ -15628,8 +10294,32 @@ index 0d731ffc..48457226 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/kubernetes/shared.yml +index 4534624b..7d1db5bb 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_mac_modification/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml +index 298aec87..772cf5d4 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_media_export/rule.yml +@@ -49,7 +49,7 @@ references: + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215 + stigid@ol7: OL07-00-030740 + stigid@rhel7: RHEL-07-030740 +- stigid@rhel8: RHEL-08-030302 ++ stigid@almalinux8: RHEL-08-030302 + stigid@sle12: SLES-12-020290 + + ocil_clause: 'there is no output' diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml -index fa07d5bf..563a4dda 100644 +index b5262d79..ffe98233 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -15639,7 +10329,7 @@ index fa07d5bf..563a4dda 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/bash/shared.sh -index 4e4869a8..a7639a3f 100644 +index 3c5e593d..5504f293 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/bash/shared.sh +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_networkconfig_modification/bash/shared.sh @@ -1,4 +1,4 @@ @@ -15668,6 +10358,100 @@ index e8801374..95ec4a64 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_session_events/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_session_events/kubernetes/shared.yml +index 1decbff9..083f80bd 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_session_events/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_session_events/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml +index f39bfa7e..02c5a419 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8,rhel9 ++prodtype: rhel8,almalinux8,rhel9 + + title: 'Ensure auditd Collects System Administrator Actions - /etc/sudoers' + +@@ -29,7 +29,7 @@ identifiers: + references: + disa: CCI-000169 + srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,CCI-002884,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221 +- stigid@rhel8: RHEL-08-030171 ++ stigid@almalinux8: RHEL-08-030171 + + ocil_clause: 'there is not output' + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml +index d4a35a79..c2acf809 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sudoers_d/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8,rhel9 ++prodtype: rhel8,almalinux8,rhel9 + + title: 'Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/' + +@@ -29,7 +29,7 @@ identifiers: + references: + disa: CCI-000169 + srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,CCI-002884,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221 +- stigid@rhel8: RHEL-08-030172 ++ stigid@almalinux8: RHEL-08-030172 + + ocil_clause: 'there is not output' + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/ansible/shared.yml +index fadb4c86..7df2e0cb 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/ansible/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_sle + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/bash/shared.sh +index 39769793..8b5bfffb 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/bash/shared.sh ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel ++# platform = multi_platform_rhel,multi_platform_almalinux + + # Include source function library. + . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml +index 04c4ce92..d1c71c4c 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel7,rhel8,sle12,sle15,ubuntu2004 ++prodtype: rhel7,rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Record Events When Privileged Executables Are Run' + +@@ -38,7 +38,7 @@ references: + nist: CM-5(1),AU-7(a),AU-7(b),AU-8(b),AU-12(3),AC-6(9) + srg: SRG-OS-000326-GPOS-00126,SRG-OS-000327-GPOS-00127,SRG-OS-000337-GPOS-00129,SRG-OS-000348-GPOS-00136,SRG-OS-000349-GPOS-00137,SRG-OS-000350-GPOS-00138,SRG-OS-000351-GPOS-00139,SRG-OS-000352-GPOS-00140,SRG-OS-000353-GPOS-00141,SRG-OS-000354-GPOS-00142,SRG-OS-000358-GPOS-00145,SRG-OS-000359-GPOS-00146,SRG-OS-000365-GPOS-00152 + stigid@rhel7: RHEL-07-030360 +- stigid@rhel8: RHEL-08-030000 ++ stigid@almalinux8: RHEL-08-030000 + stigid@sle12: SLES-12-020240 + stigid@sle15: SLES-15-030640 + stigid@ubuntu2004: UBTU-20-010211 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/bash/shared.sh index b6a4e7ef..31367467 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/bash/shared.sh @@ -15678,38 +10462,26 @@ index b6a4e7ef..31367467 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml -index df14260d..3c282656 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/rule.yml -@@ -46,7 +46,7 @@ references: - cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,APO13.01,BAI03.05,BAI08.02,DSS01.03,DSS01.04,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS03.05,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,DSS06.03,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01 - iso27001-2013: A.11.2.6,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.7,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.6.2.1,A.6.2.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,2,3,4,5,6,7,8,9 -- stigid@rhel8: RHEL-08-030172 -+ stigid@almalinux8: RHEL-08-030172 - - ocil_clause: 'there is not output' - -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/bash/shared.sh -index a349bb1c..b31fde3b 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv - - # Traverse all of: - # +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/kubernetes/shared.yml +index 5c99e72f..88c36f80 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_sysadmin_actions/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/rule.yml -index e8a2db35..5425deed 100644 +index bf283323..83356ccd 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_system_shutdown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Shutdown System When Auditing Failures Occur' @@ -15724,110 +10496,110 @@ index bb030985..53d33c43 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml -index 0af21780..fcfa6176 100644 +index 11c8f823..62fe8fa3 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_group/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Events that Modify User/Group Information - /etc/group' -@@ -53,7 +53,7 @@ references: - iso27001-2013: A.11.2.6,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.7,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.6.2.1,A.6.2.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,2,3,4,5,6,7,8,9 - stigid@sle12: SLES-12-020210 +@@ -56,7 +56,7 @@ references: + srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,CCI-002884,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221 + stigid@ol7: OL07-00-030871 + stigid@rhel7: RHEL-07-030871 - stigid@rhel8: RHEL-08-030170 + stigid@almalinux8: RHEL-08-030170 - - ocil_clause: 'the system is not configured to audit account changes' - + stigid@sle12: SLES-12-020210 + stigid@sle15: SLES-15-030010 + stigid@ubuntu2004: UBTU-20-010101 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml -index f4dce555..83036d5e 100644 +index 8ccf265d..44bafe70 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_gshadow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Events that Modify User/Group Information - /etc/gshadow' -@@ -53,7 +53,7 @@ references: - cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO12.06,APO13.01,BAI03.05,BAI08.02,DSS01.03,DSS01.04,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS03.05,DSS05.02,DSS05.03,DSS05.04,DSS05.05,DSS05.07,DSS06.03,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01 - iso27001-2013: A.11.2.6,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.7,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.6.2.1,A.6.2.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,2,3,4,5,6,7,8,9 +@@ -56,7 +56,7 @@ references: + srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221 + stigid@ol7: OL07-00-030872 + stigid@rhel7: RHEL-07-030872 - stigid@rhel8: RHEL-08-030160 + stigid@almalinux8: RHEL-08-030160 - - ocil_clause: 'the system is not configured to audit account changes' - + stigid@sle12: SLES-12-020590 + stigid@sle15: SLES-15-030040 + stigid@ubuntu2004: UBTU-20-010103 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml -index 240d4d8e..93723a7c 100644 +index b8e99f21..9b0b5353 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_opasswd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Events that Modify User/Group Information - /etc/security/opasswd' -@@ -54,7 +54,7 @@ references: - cis-csc: 1,11,12,13,14,15,16,18,19,2,3,4,5,6,7,8,9 - srg@sle12: SRG-OS-000004-GPOS-00004,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000476-GPOS-00221 - stigid@sle12: SLES-12-020230 +@@ -57,7 +57,7 @@ references: + srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,SRG-OS-000476-GPOS-00221,SRG-OS-000463-GPOS-00207 + stigid@ol7: OL07-00-030874 + stigid@rhel7: RHEL-07-030874 - stigid@rhel8: RHEL-08-030140 + stigid@almalinux8: RHEL-08-030140 - - ocil_clause: 'the system is not configured to audit account changes' - + stigid@sle12: SLES-12-020230 + stigid@sle15: SLES-15-030030 + stigid@ubuntu2004: UBTU-20-010104 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml -index 069916da..8982bf58 100644 +index aae128fe..a1d9ee19 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_passwd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Events that Modify User/Group Information - /etc/passwd' -@@ -53,7 +53,7 @@ references: - iso27001-2013: A.11.2.6,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.7,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.6.2.1,A.6.2.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,2,3,4,5,6,7,8,9 - stigid@sle12: SLES-12-020200 +@@ -56,7 +56,7 @@ references: + srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221,SRG-OS-000274-GPOS-00104,SRG-OS-000275-GPOS-00105,SRG-OS-000276-GPOS-00106,SRG-OS-000277-GPOS-00107 + stigid@ol7: OL07-00-030870 + stigid@rhel7: RHEL-07-030870 - stigid@rhel8: RHEL-08-030150 + stigid@almalinux8: RHEL-08-030150 - - ocil_clause: 'the system is not configured to audit account changes' - + stigid@sle12: SLES-12-020200 + stigid@sle15: SLES-15-030000 + stigid@ubuntu2004: UBTU-20-010100 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml -index 5c13ca58..9739f79a 100644 +index d6cede0d..971dea81 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_rules_usergroup_modification_shadow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Record Events that Modify User/Group Information - /etc/shadow' -@@ -54,7 +54,7 @@ references: - cis-csc: 1,11,12,13,14,15,16,18,19,2,3,4,5,6,7,8,9 - stigid@sle12: SLES-12-020220 - srg@sle12: SRG-OS-000004-GPOS-00004,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000476-GPOS-00221 +@@ -56,7 +56,7 @@ references: + srg: SRG-OS-000004-GPOS-00004,SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000304-GPOS-00121,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000470-GPOS-00214,SRG-OS-000471-GPOS-00215,SRG-OS-000239-GPOS-00089,SRG-OS-000240-GPOS-00090,SRG-OS-000241-GPOS-00091,SRG-OS-000303-GPOS-00120,SRG-OS-000304-GPOS-00121,SRG-OS-000466-GPOS-00210,SRG-OS-000476-GPOS-00221 + stigid@ol7: OL07-00-030873 + stigid@rhel7: RHEL-07-030873 - stigid@rhel8: RHEL-08-030130 + stigid@almalinux8: RHEL-08-030130 - - ocil_clause: 'the system is not configured to audit account changes' - + stigid@sle12: SLES-12-020220 + stigid@sle15: SLES-15-030020 + stigid@ubuntu2004: UBTU-20-010102 diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/bash/shared.sh index 1eeb41de..f0d60ef4 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/bash/shared.sh @@ -15838,8 +10610,19 @@ index 1eeb41de..f0d60ef4 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/kubernetes/shared.yml +index 3fbd4948..27378a92 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_adjtimex/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/bash/shared.sh -index ffddb94d..a75e450b 100644 +index 0d51b6b9..72a9ab19 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/bash/shared.sh +++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/bash/shared.sh @@ -1,4 +1,4 @@ @@ -15848,6 +10631,17 @@ index ffddb94d..a75e450b 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/kubernetes/shared.yml +index 18bb2671..8f0bffdd 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_clock_settime/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_settimeofday/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_settimeofday/bash/shared.sh index 1eeb41de..f0d60ef4 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_settimeofday/bash/shared.sh @@ -15858,6 +10652,17 @@ index 1eeb41de..f0d60ef4 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_settimeofday/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_settimeofday/kubernetes/shared.yml +index e2f2d649..bd5c2434 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_settimeofday/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_settimeofday/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/bash/shared.sh index 1eeb41de..f0d60ef4 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/bash/shared.sh @@ -15868,6 +10673,17 @@ index 1eeb41de..f0d60ef4 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/kubernetes/shared.yml +index 7ea72adf..28662fe8 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_stime/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/bash/shared.sh index ed5ff647..09d8474f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/bash/shared.sh @@ -15878,8 +10694,19 @@ index ed5ff647..09d8474f 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/kubernetes/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/kubernetes/shared.yml +index ac72267a..67ee8659 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/audit_time_rules/audit_rules_time_watch_localtime/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/ansible/shared.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/ansible/shared.yml -index 31b65a08..75f854d9 100644 +index ec17adf5..0ecb4079 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/ansible/shared.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -15888,16 +10715,48 @@ index 31b65a08..75f854d9 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/bash/shared.sh -index 29aff706..d58e3e59 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/bash/shared.sh -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_access_var_log_audit/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml +index 3915300c..ac1e9e88 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_group_ownership_var_log_audit/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions +-prodtype: rhel8 ++prodtype: rhel8,almalinux8 + + title: 'System Audit Directories Must Be Group Owned By Root' + +@@ -32,7 +32,7 @@ references: + nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4 + pcidss: Req-10.5.1 + srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-030110 ++ stigid@almalinux8: RHEL-08-030110 + + ocil: |- + {{{ describe_file_group_owner(file="/var/log/audit", group="root") }}} +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml +index cd6c45e2..6b327227 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_ownership_var_log_audit/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8 ++prodtype: rhel8,almalinux8 + + title: 'System Audit Directories Must Be Owned By Root' + +@@ -30,7 +30,7 @@ references: + nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4 + pcidss: Req-10.5.1 + srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-030100 ++ stigid@almalinux8: RHEL-08-030100 + + ocil: |- + {{{ describe_file_owner(file="/var/log/audit", owner="root") }}} diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh index fb64c243..30e0c22f 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/directory_permissions_var_log_audit/bash/shared.sh @@ -15909,31 +10768,60 @@ index fb64c243..30e0c22f 100644 if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ') diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/directory_permissions_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/directory_permissions_var_log_audit/rule.yml -index 65dc7861..74c7cee4 100644 +index fde4f452..372023ef 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/directory_permissions_var_log_audit/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/directory_permissions_var_log_audit/rule.yml -@@ -26,7 +26,7 @@ references: - cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8 +@@ -30,7 +30,7 @@ references: + nist: CM-6(a),AC-6(1),AU-9 + nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4 + srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029 - stigid@rhel8: RHEL-08-030120 + stigid@almalinux8: RHEL-08-030120 - srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029 ocil_clause: 'any are more permissive' -diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml -index e495992e..2389df1f 100644 ---- a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml -+++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit/rule.yml -@@ -33,7 +33,7 @@ references: - cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8 + +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml +index 767c8c89..6b0b1074 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_group_ownership_var_log_audit/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8 ++prodtype: rhel8,almalinux8 + + title: 'System Audit Logs Must Be Group Owned By Root' + +@@ -32,7 +32,7 @@ references: + nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4 + pcidss: Req-10.5.1 + srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-030090 ++ stigid@almalinux8: RHEL-08-030090 + + ocil: |- + {{{ describe_file_group_owner(file="/var/log/audit/*", group="root") }}} +diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml +index 7f895759..c6d2eb2d 100644 +--- a/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml ++++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_ownership_var_log_audit_stig/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8 ++prodtype: rhel8,almalinux8 + + title: 'System Audit Logs Must Be Owned By Root' + +@@ -30,7 +30,7 @@ references: + nist-csf: DE.AE-3,DE.AE-5,PR.AC-4,PR.DS-5,PR.PT-1,RS.AN-1,RS.AN-4 + pcidss: Req-10.5.1 + srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084 - stigid@rhel8: RHEL-08-030080 + stigid@almalinux8: RHEL-08-030080 ocil: |- - {{{ describe_file_owner(file="/var/log/audit", owner="root") }}} + {{{ describe_file_owner(file="/var/log/audit/*", owner="root") }}} diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh index d6c45867..17a30a70 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/bash/shared.sh @@ -15945,33 +10833,33 @@ index d6c45867..17a30a70 100644 if LC_ALL=C grep -m 1 -q ^log_group /etc/audit/auditd.conf; then GROUP=$(awk -F "=" '/log_group/ {print $2}' /etc/audit/auditd.conf | tr -d ' ') diff --git a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml -index eae8a2df..19e2cf09 100644 +index 9a9d68be..c22dbf8a 100644 --- a/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml +++ b/linux_os/guide/system/auditing/auditd_configure_rules/file_permissions_var_log_audit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'System Audit Logs Must Have Mode 0640 or Less Permissive' -@@ -36,7 +36,7 @@ references: - cobit5: APO01.06,APO11.04,APO12.06,BAI03.05,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,DSS06.02,MEA02.01 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.16.1.4,A.16.1.5,A.16.1.7,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,19,3,4,5,6,7,8 +@@ -38,7 +38,7 @@ references: + srg: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000206-GPOS-00084 + stigid@ol7: OL07-00-910055 + stigid@rhel7: RHEL-07-910055 - stigid@rhel8: RHEL-08-030070 + stigid@almalinux8: RHEL-08-030070 ocil_clause: 'any are more permissive' diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/ansible/shared.yml -index b3f245c9..9377f247 100644 +index eb3fd508..6dec3bcd 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/ansible/shared.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/ansible/shared.yml @@ -1,11 +1,11 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux,multi_platform_sle # reboot = false # strategy = configure # complexity = low @@ -15984,12 +10872,12 @@ index b3f245c9..9377f247 100644 {{% else %}} {{% set audisp_config_file_path = "/etc/audisp/audisp-remote.conf" %}} diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/bash/shared.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/bash/shared.sh -index 0e3d32fd..9eedc5a5 100644 +index 4d37c760..88367768 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/bash/shared.sh +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/bash/shared.sh @@ -1,8 +1,8 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_wrlinux,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_wrlinux,multi_platform_sle . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_audispd_remote_server") }}} @@ -16009,14 +10897,14 @@ index 8fa77047..4faca2da 100644 {{% else %}} {{% set audisp_config_file_path = "/etc/audisp/audisp-remote.conf" %}} diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/rule.yml -index c19af71b..1ef76084 100644 +index 507f7d33..52943889 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_remote_server/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Configure audispd Plugin To Send Logs To Remote Server' @@ -16029,7 +10917,7 @@ index c19af71b..1ef76084 100644 /etc/audit/audisp-remote.conf {{%- else -%}} /etc/audisp/audisp-remote.conf -@@ -42,11 +42,10 @@ ocil_clause: 'audispd is not sending logs to a remote system' +@@ -48,11 +48,10 @@ ocil_clause: 'audispd is not sending logs to a remote system' ocil: |- To verify the audispd plugin off-loads audit records onto a different system or media from the system being audited, run the following command: @@ -16064,15 +10952,36 @@ index 29cf6015..61a9640e 100644 . $SHARED/auditd_utils.sh prepare_auditd_test_enviroment +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_sufficiently_large_partition/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_sufficiently_large_partition/rule.yml +index a7f7a069..e37cc11c 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_sufficiently_large_partition/rule.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_configure_sufficiently_large_partition/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8,sle12,sle15,ubuntu2004 ++prodtype: rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Configure a Sufficiently Large Partition for Audit Logs' + +@@ -43,7 +43,7 @@ references: + disa: CCI-001849 + nist@sle15: AU-4 + srg: SRG-OS-000341-GPOS-00132,SRG-OS-000342-GPOS-00133 +- stigid@rhel8: RHEL-08-030660 ++ stigid@almalinux8: RHEL-08-030660 + stigid@sle12: SLES-12-020020 + stigid@sle15: SLES-15-030660 + stigid@ubuntu2004: UBTU-20-010215 diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_disk_full_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_disk_full_action/rule.yml -index d3bf2845..2cf0d67d 100644 +index e5c33838..b855ec67 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_disk_full_action/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_disk_full_action/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Configure audispd''s Plugin disk_full_action When Disk Is Full' @@ -16119,14 +11028,14 @@ index 1e21e071..04f841d1 100644 {{% else %}} <ind:pattern operation="pattern match">^[ ]*enable_krb5[ ]+=[ ]+yes[ ]*$</ind:pattern> diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml -index 1943a00f..fc7380b7 100644 +index 9c3f34e2..cad24ae9 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_encrypt_sent_records/rule.yml @@ -1,13 +1,13 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Encrypt Audit Records Sent With audispd Plugin' @@ -16138,25 +11047,7 @@ index 1943a00f..fc7380b7 100644 Set the <tt>transport</tt> option in <pre>/etc/audit/audisp-remote.conf</pre> to <tt>KRB5</tt>. {{% else %}} -@@ -26,7 +26,7 @@ severity: medium - identifiers: - cce@rhel7: CCE-80540-8 - cce@rhel8: CCE-80926-9 -- cce@sle12: CCE-83063-8 -+ cce@sle12: CCE-83063-8 - - references: - stigid@ol7: OL07-00-030310 -@@ -34,7 +34,7 @@ references: - nist: AU-9(3),CM-6(a) - srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 - stigid@rhel7: RHEL-07-030310 -- stigid@sle12: SLES-12-030340 -+ stigid@sle12: SLES-12-030340 - ospp: FAU_GEN.1.1.c - - ocil_clause: 'audispd is not encrypting audit records when sent over the network' -@@ -42,7 +42,7 @@ ocil_clause: 'audispd is not encrypting audit records when sent over the network +@@ -44,7 +44,7 @@ ocil_clause: 'audispd is not encrypting audit records when sent over the network ocil: |- To verify the audispd plugin encrypts audit records off-loaded onto a different system or media from the system being audited, run the following command: @@ -16165,7 +11056,7 @@ index 1943a00f..fc7380b7 100644 <pre>$ sudo grep -i transport /etc/audit/audisp-remote.conf</pre> The output should return the following: <pre>transport = KRB5</pre> -@@ -51,4 +51,3 @@ ocil: |- +@@ -53,4 +53,3 @@ ocil: |- The output should return the following: <pre>enable_krb5 = yes</pre> {{% endif %}} @@ -16215,14 +11106,14 @@ index 7d594d64..5d1ae6e8 100644 . $SHARED/auditd_utils.sh prepare_auditd_test_enviroment diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_network_failure_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_network_failure_action/rule.yml -index f756e479..c0b4f1ce 100644 +index 08d2794f..8e3bc55b 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_network_failure_action/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_network_failure_action/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Configure audispd''s Plugin network_failure_action On Network Failure' @@ -16274,7 +11165,7 @@ index 834225ca..6c4ff9cd 100644 {{% else %}} <ind:filepath>/etc/audisp/plugins.d/syslog.conf</ind:filepath> diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_syslog_plugin_activated/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_syslog_plugin_activated/rule.yml -index c42c90a8..b728269f 100644 +index dbea37d7..41dce950 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_syslog_plugin_activated/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_audispd_syslog_plugin_activated/rule.yml @@ -6,7 +6,7 @@ description: |- @@ -16286,7 +11177,7 @@ index c42c90a8..b728269f 100644 /etc/audit/plugins.d/syslog.conf {{%- else -%}} /etc/audisp/plugins.d/syslog.conf -@@ -48,10 +48,9 @@ ocil_clause: 'it is not activated' +@@ -49,10 +49,9 @@ ocil_clause: 'it is not activated' ocil: |- To verify the audispd's syslog plugin is active, run the following command: @@ -16351,19 +11242,30 @@ index 2b17ddd8..bccaaab8 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_auditd_disk_error_action") }}} +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/rule.yml -index 8e6836ae..4c7e458a 100644 +index c5980c53..d84e6760 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_error_action/rule.yml -@@ -34,7 +34,7 @@ references: - cobit5: APO11.04,APO12.06,APO13.01,BAI03.05,BAI04.04,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,MEA02.01 - iso27001-2013: A.12.1.3,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.16.1.4,A.16.1.5,A.16.1.7,A.17.2.1 - cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8 +@@ -37,7 +37,7 @@ references: + nist: AU-5(b),AU-5(2),AU-5(1),AU-5(4),CM-6(a) + nist-csf: DE.AE-3,DE.AE-5,PR.DS-4,PR.PT-1,RS.AN-1,RS.AN-4 + srg: SRG-OS-000047-GPOS-00023 - stigid@rhel8: RHEL-08-030040 + stigid@almalinux8: RHEL-08-030040 - srg: SRG-OS-000047-GPOS-00023 ocil_clause: 'the system is not configured to switch to single-user mode for corrective action' + diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/ansible/shared.yml index 61cc4751..7f66a5c1 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/ansible/shared.yml @@ -16384,19 +11286,30 @@ index b136cc1a..47d47eb7 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/rule.yml -index 6b7dddb0..e9044642 100644 +index 8639563f..4add5423 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_disk_full_action/rule.yml -@@ -41,7 +41,7 @@ references: - srg@sle12: SRG-OS-000047-GPOS-00023 - disa@sle12: CCI-000140 +@@ -42,7 +42,7 @@ references: + nist-csf: DE.AE-3,DE.AE-5,PR.DS-4,PR.PT-1,RS.AN-1,RS.AN-4 nist@sle12: AU-5(b),AU-5.1(iv) + srg: SRG-OS-000047-GPOS-00023 - stigid@rhel8: RHEL-08-030060 + stigid@almalinux8: RHEL-08-030060 - srg: SRG-OS-000047-GPOS-00023 - - ocil_clause: 'the system is not configured to switch to single-user mode for corrective action' + stigid@sle12: SLES-12-020060 + stigid@sle15: SLES-15-030590 + stigid@ubuntu2004: UBTU-20-010118 diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/ansible/shared.yml index b82e6d17..717e52b9 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/ansible/shared.yml @@ -16418,18 +11331,18 @@ index ac78fe87..5fcd1604 100644 {{{ bash_instantiate_variables("var_auditd_action_mail_acct") }}} diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/rule.yml -index 8325306a..fce1cff3 100644 +index 938096ef..73e0e8cb 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_action_mail_acct/rule.yml -@@ -43,7 +43,7 @@ references: - srg@sle12: SRG-OS-000046-GPOS-00022 - disa@sle12: CCI-000139 - nist@sle12: AU-5(a),AU-5.1(ii) +@@ -44,7 +44,7 @@ references: + srg: SRG-OS-000046-GPOS-00022,SRG-OS-000343-GPOS-00134 + stigid@ol7: OL07-00-030350 + stigid@rhel7: RHEL-07-030350 - stigid@rhel8: RHEL-08-030020 + stigid@almalinux8: RHEL-08-030020 - - ocil_clause: 'auditd is not configured to send emails per identified actions' - + stigid@sle12: SLES-12-020040 + stigid@sle15: SLES-15-030570 + stigid@ubuntu2004: UBTU-20-010117 diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_action/ansible/shared.yml index 93d076fa..02b862b9 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_action/ansible/shared.yml @@ -16450,6 +11363,17 @@ index 0c23a906..4b96b471 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_auditd_admin_space_left_action") }}} +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_action/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_action/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_action/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_action/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/ansible/shared.yml index f909e5ec..72f7c8c4 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/ansible/shared.yml @@ -16471,24 +11395,25 @@ index efe151c6..88fb23c1 100644 {{{ bash_instantiate_variables("var_auditd_flush") }}} diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/kubernetes/shared.yml -index ed780837..63e7015d 100644 +index c865ad76..f226ae34 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/rule.yml -index 8b889b9d..76af1fca 100644 +index 3fb448e5..d8217375 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_flush/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Configure auditd flush priority' @@ -16578,6 +11503,17 @@ index 9f405890..ceda723b 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_auditd_max_log_file") }}} +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/ansible/shared.yml index 595959e0..28abf5c2 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/ansible/shared.yml @@ -16598,19 +11534,30 @@ index 42f987dd..8e13a71d 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_auditd_max_log_file_action") }}} +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/rule.yml -index 07c21ca5..8a377220 100644 +index 15e21e45..be2d0fbb 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_max_log_file_action/rule.yml -@@ -44,7 +44,7 @@ references: - isa-62443-2009: 4.2.3.10,4.3.3.3.9,4.3.3.5.8,4.3.4.4.7,4.3.4.5.6,4.3.4.5.7,4.3.4.5.8,4.4.2.1,4.4.2.2,4.4.2.4 - cobit5: APO11.04,APO12.06,APO13.01,BAI03.05,BAI04.04,BAI08.02,DSS02.02,DSS02.04,DSS02.07,DSS03.01,DSS05.04,DSS05.07,MEA02.01 - cis-csc: 1,11,12,13,14,15,16,19,2,3,4,5,6,7,8 +@@ -49,7 +49,7 @@ references: + nist-csf: DE.AE-3,DE.AE-5,PR.DS-4,PR.PT-1,RS.AN-1,RS.AN-4 + pcidss: Req-10.7 + srg: SRG-OS-000047-GPOS-00023 - stigid@rhel8: RHEL-08-030050 + stigid@almalinux8: RHEL-08-030050 - srg: SRG-OS-000047-GPOS-00023 ocil_clause: 'the system has not been properly configured to rotate audit logs' + diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_num_logs/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_num_logs/ansible/shared.yml index 6fe9e014..7b15c894 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_num_logs/ansible/shared.yml @@ -16621,6 +11568,17 @@ index 6fe9e014..7b15c894 100644 # reboot = false # strategy = restrict # complexity = low +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_num_logs/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_num_logs/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_num_logs/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_num_logs/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/ansible/shared.yml index ab0bea58..a6158699 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/ansible/shared.yml @@ -16641,27 +11599,29 @@ index 9b79489b..1315f39b 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_auditd_space_left") }}} +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml -index 7d845954..545f255d 100644 +index a652d15d..f88a86d9 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Configure auditd space_left on Low Disk Space' -@@ -43,7 +43,7 @@ references: - srg@sle12: SRG-OS-000343-GPOS-00134 - disa@sle12: CCI-001855 - nist@sle12: AU-5(1) -- stigid@rhel8: RHEL-08-030730 -+ stigid@almalinux8: RHEL-08-030730 - - ocil_clause: 'the system is not configured a specfic size in MB to notify administrators of an issue' - diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/ansible/shared.yml index 04062e34..3b30d2ea 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/ansible/shared.yml @@ -16682,95 +11642,178 @@ index 1d2b211c..d7fdf9be 100644 . /usr/share/scap-security-guide/remediation_functions {{{ bash_instantiate_variables("var_auditd_space_left_action") }}} +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/kubernetes/shared.yml +index c865ad76..f226ae34 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/kubernetes/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml +index 7569a677..8069100c 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_action/rule.yml +@@ -53,7 +53,7 @@ references: + srg: SRG-OS-000343-GPOS-00134 + stigid@ol7: OL07-00-030340 + stigid@rhel7: RHEL-07-030340 +- stigid@rhel8: RHEL-08-030731 ++ stigid@almalinux8: RHEL-08-030731 + stigid@ubuntu2004: UBTU-20-010217 + vmmsrg: SRG-OS-000343-VMM-001240 + +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml +index ea9d9fcc..4ad6fc13 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_data_retention_space_left_percentage/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 + + title: 'Configure auditd space_left on Low Disk Space' + +@@ -35,7 +35,7 @@ references: + pcidss: Req-10.7 + srg: SRG-OS-000343-GPOS-00134 + stigid@rhel7: RHEL-07-030330 +- stigid@rhel8: RHEL-08-030730 ++ stigid@almalinux8: RHEL-08-030730 + vmmsrg: SRG-OS-000343-VMM-001240 + + ocil_clause: 'the system is not configured with a specific percentage to notify administrators of an issue' diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_freq/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_freq/kubernetes/shared.yml -index ed780837..63e7015d 100644 +index c865ad76..f226ae34 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_freq/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_freq/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/kubernetes/shared.yml -index ed780837..63e7015d 100644 +index c865ad76..f226ae34 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml -index 5afb2c8f..19d74967 100644 +index 0eaf0d3e..28016ed4 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_local_events/rule.yml -@@ -21,7 +21,7 @@ identifiers: - references: +@@ -23,7 +23,7 @@ references: + disa: CCI-000366 ospp: FAU_GEN.1.1.c - srg: SRG-OS-000062-GPOS-00031 + srg: SRG-OS-000062-GPOS-00031,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-030061 + stigid@almalinux8: RHEL-08-030061 ocil_clause: local_events isn't set to yes diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/kubernetes/shared.yml -index ed780837..63e7015d 100644 +index c865ad76..f226ae34 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml -index 76d31a6f..64ed5573 100644 +index 7113b0c6..4463bd2e 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_log_format/rule.yml -@@ -22,7 +22,7 @@ identifiers: - references: +@@ -24,7 +24,7 @@ references: + disa: CCI-000366 ospp: FAU_GEN.1 - srg: SRG-OS-000255-GPOS-00096 + srg: SRG-OS-000255-GPOS-00096,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-030063 + stigid@almalinux8: RHEL-08-030063 ocil_clause: log_format isn't set to ENRICHED diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/kubernetes/shared.yml -index ed780837..63e7015d 100644 +index c865ad76..f226ae34 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml -index a778d5fa..6e203408 100644 +index b0bbf91f..aa24cbc0 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_name_format/rule.yml -@@ -25,7 +25,7 @@ references: - disa: CCI-001851 +@@ -26,7 +26,7 @@ references: ospp: FAU_GEN.1 srg: SRG-OS-000039-GPOS-00017,SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 + stigid@ol7: OL07-00-030211 - stigid@rhel8: RHEL-08-030062 + stigid@almalinux8: RHEL-08-030062 ocil_clause: name_format isn't set to hostname +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml +index e1569b22..2ff0cf3b 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_fedora,multi_platform_rhel ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh +index b397c811..dc9f2eae 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_fedora,multi_platform_rhel ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml +index d41ca000..f9946de8 100644 +--- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml ++++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_overflow_action/rule.yml +@@ -21,7 +21,7 @@ references: + disa: CCI-001851 + nist: AU-4(1) + srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 +- stigid@rhel8: RHEL-08-030700 ++ stigid@almalinux8: RHEL-08-030700 + + ocil_clause: 'auditd overflow action is not setup correctly' + diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/kubernetes/shared.yml b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/kubernetes/shared.yml -index ed780837..63e7015d 100644 +index c865ad76..f226ae34 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/configure_auditd_data_retention/auditd_write_logs/kubernetes/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora - apiVersion: machineconfiguration.openshift.io/v1 - kind: MachineConfig - spec: +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/auditing/configure_auditd_data_retention/var_audispd_remote_server.var b/linux_os/guide/system/auditing/configure_auditd_data_retention/var_audispd_remote_server.var index bcafc35b..9e8abe6c 100644 --- a/linux_os/guide/system/auditing/configure_auditd_data_retention/var_audispd_remote_server.var @@ -16784,51 +11827,29 @@ index bcafc35b..9e8abe6c 100644 The setting for remote_server in /etc/audit/audisp-remote.conf {{% else %}} The setting for remote_server in /etc/audisp/audisp-remote.conf -diff --git a/linux_os/guide/system/auditing/group.yml b/linux_os/guide/system/auditing/group.yml -index 82f87e81..a6371326 100644 ---- a/linux_os/guide/system/auditing/group.yml -+++ b/linux_os/guide/system/auditing/group.yml -@@ -37,11 +37,7 @@ description: |- - requirements. - Examining some example audit records demonstrates how the Linux audit system - satisfies common requirements. -- The following example from Fedora Documentation available at -- <tt>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/sect-Security-Enhanced_Linux-Troubleshooting-Fixing_Problems.html#sect-Security-Enhanced_Linux-Fixing_Problems-Raw_Audit_Messages") }}}</tt> -- shows the substantial amount of information captured in a -- two typical "raw" audit messages, followed by a breakdown of the most important -- fields. In this example the message is SELinux-related and reports an AVC -+ In this example the message is SELinux-related and reports an AVC - denial (and the associated system call) that occurred when the Apache HTTP - Server attempted to access the <tt>/var/www/html/file1</tt> file (labeled with - the <tt>samba_share_t</tt> type): -@@ -103,4 +99,3 @@ description: |- - </li></ul> - - platform: machine -- diff --git a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml -index d033770f..12be1fad 100644 +index 73317286..8047c909 100644 --- a/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml +++ b/linux_os/guide/system/auditing/grub2_audit_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Enable Auditing for Processes Which Start Prior to the Audit Daemon' -@@ -45,7 +45,7 @@ references: - iso27001-2013: A.11.2.6,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.2.1,A.14.1.3,A.15.2.1,A.15.2.2,A.16.1.4,A.16.1.5,A.16.1.7,A.6.2.1,A.6.2.2 - cis-csc: 1,11,12,13,14,15,16,19,3,4,5,6,7,8 - srg: SRG-OS-000254-GPOS-00095 +@@ -47,7 +47,7 @@ references: + nist-csf: DE.AE-3,DE.AE-5,ID.SC-4,PR.AC-3,PR.PT-1,PR.PT-4,RS.AN-1,RS.AN-4 + pcidss: Req-10.3 + srg: SRG-OS-000037-GPOS-00015,SRG-OS-000042-GPOS-00020,SRG-OS-000062-GPOS-00031,SRG-OS-000392-GPOS-00172,SRG-OS-000462-GPOS-00206,SRG-OS-000471-GPOS-00215,SRG-OS-000473-GPOS-00218,SRG-OS-000254-GPOS-00095 - stigid@rhel8: RHEL-08-030601 + stigid@almalinux8: RHEL-08-030601 + stigid@ubuntu2004: UBTU-20-010198 + vmmsrg: SRG-OS-000254-VMM-000880 - ocil_clause: 'auditing is not enabled at boot time' - -@@ -96,9 +96,9 @@ warnings: - <pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> +@@ -100,9 +100,9 @@ warnings: + <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command as <tt>root</tt>: {{% if product in ["rhel7", "ol7", "rhel8", "ol8"] %}} - <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> @@ -16884,28 +11905,28 @@ index 59f1ed22..e9cac86b 100644 # Break the audit argument in kernel command line in /boot/grub2/grubenv file="/boot/grub2/grubenv" diff --git a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml -index 27e19e7c..cc40510b 100644 +index 93348c40..d62294e0 100644 --- a/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml +++ b/linux_os/guide/system/auditing/grub2_audit_backlog_limit_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Extend Audit Backlog Limit for the Audit Daemon' -@@ -27,7 +27,7 @@ references: - srg: SRG-OS-000254-GPOS-00095 +@@ -31,7 +31,7 @@ references: + disa: CCI-001849 nist: CM-6(a) - cis@rhel8: 4.1.1.4 + srg: SRG-OS-000254-GPOS-00095,SRG-OS-000341-GPOS-00132 - stigid@rhel8: RHEL-08-030602 + stigid@almalinux8: RHEL-08-030602 ocil_clause: 'audit backlog limit is not configured' -@@ -54,9 +54,9 @@ warnings: - <pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> +@@ -58,9 +58,9 @@ warnings: + <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command as <tt>root</tt>: {{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}} - <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> @@ -16938,408 +11959,423 @@ index 921c9db9..d54cf31e 100644 # Break the audit_backlog_limit argument in kernel command line in /boot/grub2/grubenv file="/boot/grub2/grubenv" diff --git a/linux_os/guide/system/auditing/package_audispd-plugins_installed/rule.yml b/linux_os/guide/system/auditing/package_audispd-plugins_installed/rule.yml -index 8ed5af70..f448e8e3 100644 +index 864e508b..7c9d8a3f 100644 --- a/linux_os/guide/system/auditing/package_audispd-plugins_installed/rule.yml +++ b/linux_os/guide/system/auditing/package_audispd-plugins_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install audispd-plugins Package' +diff --git a/linux_os/guide/system/auditing/package_audit_installed/rule.yml b/linux_os/guide/system/auditing/package_audit_installed/rule.yml +index cfac7564..8525cdb5 100644 +--- a/linux_os/guide/system/auditing/package_audit_installed/rule.yml ++++ b/linux_os/guide/system/auditing/package_audit_installed/rule.yml +@@ -26,7 +26,7 @@ references: + nist: AC-7(a),AU-7(1),AU-7(2),AU-14,AU-12(2),AU-2(a),CM-6(a) + nist@sle12: AU-7(a),AU-7(b),AU-8(b),AU-12.1(iv),AU-12(3),AU-12(c),CM-5(1) + srg: SRG-OS-000122-GPOS-00063,SRG-OS-000337-GPOS-00129,SRG-OS-000348-GPOS-00136,SRG-OS-000349-GPOS-00137,SRG-OS-000350-GPOS-00138,SRG-OS-000351-GPOS-00139,SRG-OS-000352-GPOS-00140,SRG-OS-000353-GPOS-00141,SRG-OS-000354-GPOS-00142,SRG-OS-000358-GPOS-00145,SRG-OS-000359-GPOS-00146,SRG-OS-000365-GPOS-00152,SRG-OS-000474-GPOS-00219,SRG-OS-000475-GPOS-00220,SRG-OS-000480-GPOS-00227,SRG-OS-000062-GPOS-00031 +- stigid@rhel8: RHEL-08-030180 ++ stigid@almalinux8: RHEL-08-030180 + stigid@sle12: SLES-12-020000 + stigid@sle15: SLES-15-030650 + stigid@ubuntu2004: UBTU-20-010182 diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/kubernetes/shared.yml -index a11fe8e7..cadd6b43 100644 +index e3314050..603abfb9 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml -index 458ac7e0..91d95484 100644 +index 5750df30..081f341f 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_access_failed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of unsuccessful file accesses' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_success/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_success/kubernetes/shared.yml -index d4e767f0..e0f28eed 100644 +index 41329308..3f8c50a3 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_access_success/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_access_success/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml -index 06461871..9d11af17 100644 +index 828ddf24..774bfe3b 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_access_success/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of successful file accesses' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/kubernetes/shared.yml -index 6991012e..d64f936a 100644 +index f6242690..bd3ddd10 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml -index cce5e83f..01125937 100644 +index 874c3d8b..89662c9a 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_basic_configuration/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure basic parameters of Audit system' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_create_failed/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_create_failed/kubernetes/shared.yml -index 2183f473..a77b9b9c 100644 +index 981a0c86..ab7d657c 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_create_failed/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_create_failed/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml -index 92800b47..f4c64daa 100644 +index 9da4d3b6..1a2380ac 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_create_failed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of unsuccessful file creations' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml -index 59db7b10..e0f89068 100644 +index dd3a8729..694f9d4e 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_create_success/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of successful file creations' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/kubernetes/shared.yml -index 17ba8b31..d4198635 100644 +index 023388b6..655883af 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml -index 2f67a150..402cc6e9 100644 +index 25446601..9e62b155 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_failed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of unsuccessful file deletions' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_success/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_success/kubernetes/shared.yml -index 2b34b1ea..783f64cb 100644 +index 6c42b726..1da7bb5f 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_delete_success/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_success/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos {{% set file_contents = """## Successful file delete -a always,exit -F arch=b32 -S unlink,unlinkat,rename,renameat -F success=1 -F auid>=1000 -F auid!=unset -F key=successful-delete diff --git a/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml -index f54899fb..afae21b8 100644 +index 21e06846..cd3106a8 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_delete_success/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of successful file deletions' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/kubernetes/shared.yml -index 95e6a2e6..4513e314 100644 +index 4b611673..42e1c3da 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml -index 073f29c9..7fd6d37b 100644 +index 261dc184..fa34df2d 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_immutable_login_uids/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure immutable Audit login UIDs' -@@ -37,7 +37,7 @@ references: - ospp: FAU_GEN.1.1.c +@@ -39,7 +39,7 @@ references: nist: AU-2(a) - srg: SRG-OS-000462-GPOS-00206,SRG-OS-000475-GPOS-00220 + ospp: FAU_GEN.1.1.c + srg: SRG-OS-000462-GPOS-00206,SRG-OS-000475-GPOS-00220,SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029 - stigid@rhel8: RHEL-08-030122 + stigid@almalinux8: RHEL-08-030122 ocil_clause: 'the file does not exist or the content differs' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/kubernetes/shared.yml -index 3bdfdf8d..6a749287 100644 +index 2d927984..ec647737 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/rule.yml -index 51f9d76f..b17430b0 100644 +index 0f5b9e71..348ffd3c 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_modify_failed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of unsuccessful file modifications' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_modify_success/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_modify_success/kubernetes/shared.yml -index 430d311e..9b41639f 100644 +index c6f79696..7a6e545c 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_modify_success/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_modify_success/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_modify_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_modify_success/rule.yml -index b51acc04..61d188ba 100644 +index 4e9f89e2..1e21d871 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_modify_success/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_modify_success/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of successful file modifications' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_module_load/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_module_load/kubernetes/shared.yml -index f3fc0dfe..8be58e06 100644 +index f8cd8b73..090554c0 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_module_load/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_module_load/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_module_load/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_module_load/rule.yml -index 20bfca83..7765bbb8 100644 +index 47b5571f..25d54199 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_module_load/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_module_load/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of loading and unloading of kernel modules' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/kubernetes/shared.yml b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/kubernetes/shared.yml -index d59066cc..d5f6a099 100644 +index a93771e8..22e9b17b 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml -index fbf7473c..8a689516 100644 +index c0e19ac1..9e4fac45 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_ospp_general/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Perform general configuration of Audit for OSPP' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_owner_change_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_owner_change_failed/rule.yml -index b0052f8b..3ed378c2 100644 +index 16dbfe6d..2ad71622 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_owner_change_failed/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_owner_change_failed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of unsuccessful ownership changes' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_owner_change_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_owner_change_success/rule.yml -index 3657a32f..e8b48130 100644 +index a4db8e4b..44c40cc6 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_owner_change_success/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_owner_change_success/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of successful ownership changes' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_perm_change_failed/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_perm_change_failed/rule.yml -index 477c7428..24d60623 100644 +index fcead862..353d4970 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_perm_change_failed/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_perm_change_failed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of unsuccessful permission changes' diff --git a/linux_os/guide/system/auditing/policy_rules/audit_perm_change_success/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_perm_change_success/rule.yml -index 53ecf9d5..c193d45b 100644 +index 75fa61ad..bb9504db 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_perm_change_success/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_perm_change_success/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8,rhcos4 -+prodtype: ol8,rhel8,almalinux8,rhcos4 +-prodtype: ol8,rhcos4,rhel8,rhel9 ++prodtype: ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Configure auditing of successful permission changes' -diff --git a/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/bash/shared.sh b/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/bash/shared.sh -index a3bf5607..be1129db 100644 ---- a/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/bash/shared.sh -+++ b/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol - - cp /usr/share/doc/audit*/rules/10-base-config.rules /etc/audit/rules.d - cp /usr/share/doc/audit*/rules/11-loginuid.rules /etc/audit/rules.d diff --git a/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/rule.yml b/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/rule.yml -index 26e7016c..33af252a 100644 +index d460ded7..5f1f0142 100644 --- a/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/rule.yml +++ b/linux_os/guide/system/auditing/policy_rules/audit_rules_for_ospp/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Configure audit according to OSPP requirements' diff --git a/linux_os/guide/system/auditing/service_auditd_enabled/kubernetes/shared.yml b/linux_os/guide/system/auditing/service_auditd_enabled/kubernetes/shared.yml -index 2ab43f2b..71cf219a 100644 +index 0d05bd46..ea629355 100644 --- a/linux_os/guide/system/auditing/service_auditd_enabled/kubernetes/shared.yml +++ b/linux_os/guide/system/auditing/service_auditd_enabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos +# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml -index d09446bd..86f0ceb1 100644 +index c7ce75e8..6b99bd3e 100644 --- a/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml +++ b/linux_os/guide/system/auditing/service_auditd_enabled/rule.yml -@@ -52,7 +52,7 @@ references: - srg@sle12: SRG-OS-000037-GPOS-00015,SRG-OS-000038-GPOS-00016,SRG-OS-000039-GPOS-00017,SRG-OS-000040-GPOS-00018,SRG-OS-000041-GPOS-00019,SRG-OS-000042-GPOS-00021,SRG-OS-000051-GPOS-00024,SRG-OS-000054-GPOS-00025,SRG-OS-000122-GPOS-00063,SRG-OS-000254-GPOS-00095,SRG-OS-000255-GPOS-00096,SRG-OS-000392-GPOS-00172,SRG-OS-000480-GPOS-00227 - disa@sle12: CCI-000130,CCI-000131,CCI-000132,CCI-000133,CCI-000134,CCI-000135,CCI-000154,CCI-000158,CCI-000366,CCI-001464,CCI-001487,CCI-001876,CCI-002884 +@@ -55,7 +55,7 @@ references: + stigid@sle12: SLES-12-020010 + stigid@sle15: SLES-15-030050 nist@sle12: AU-3,AU-3(1),AU-3(1).1(ii),AU-3.1,AU-6(4),AU-6(4).1,AU-7(1),AU-7(1).1,AU-7(a),AU-14(1),AU-14(1).1,CM-6(b),CM-6.1(iv),MA-4(1)(a) -- stigid@rhel8: RHEL-08-010560 -+ stigid@almalinux8: RHEL-08-010560 - - ocil: '{{{ ocil_service_enabled(service="auditd") }}}' +- stigid@rhel8: RHEL-08-030381 ++ stigid@almalinux8: RHEL-08-030381 + ocil: |- + {{{ ocil_service_enabled(service="auditd") }}} diff --git a/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml -index 89ffe074..288b83a0 100644 +index 308ae9cb..514343ac 100644 --- a/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/grub2_kernel_trust_cpu_rng/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8 -+prodtype: rhel8,almalinux8 +-prodtype: ol8,rhel8,rhel9 ++prodtype: ol8,rhel8,almalinux8,rhel9 title: 'Configure kernel to trust the CPU random number generator' diff --git a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml -index e3b63d96..e1e10d72 100644 +index 6201af25..49aa91dc 100644 --- a/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/grub2_pti_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8 -+prodtype: fedora,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 title: 'Enable Kernel Page-Table Isolation (KPTI)' -@@ -25,7 +25,7 @@ identifiers: - references: - srg: SRG-OS-000433-GPOS-00193 +@@ -27,7 +27,7 @@ references: + disa: CCI-000381 nist: SI-16 + srg: SRG-OS-000433-GPOS-00193,SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040004 + stigid@almalinux8: RHEL-08-040004 ocil_clause: 'Kernel page-table isolation is not enabled' -@@ -52,9 +52,9 @@ warnings: - <pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> +@@ -54,9 +54,9 @@ warnings: + <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command as <tt>root</tt>: {{% if product in ["rhel8", "ol8"] %}} - <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> @@ -17384,28 +12420,28 @@ index b4dd962b..c4092a2d 100644 # Break the pti argument in kernel command line in /boot/grub2/grubenv file="/boot/grub2/grubenv" diff --git a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml -index b0904920..89b83462 100644 +index 6e020eb0..9e9156b8 100644 --- a/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/grub2_vsyscall_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable vsyscalls' -@@ -24,7 +24,7 @@ identifiers: - references: - srg: SRG-OS-000480-GPOS-00227 +@@ -26,7 +26,7 @@ references: + disa: CCI-001084 nist: CM-7(a) + srg: SRG-OS-000480-GPOS-00227,SRG-OS-000134-GPOS-00068 - stigid@rhel8: RHEL-08-010422 + stigid@almalinux8: RHEL-08-010422 ocil_clause: 'vsyscalls are enabled' -@@ -51,9 +51,9 @@ warnings: - <pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> +@@ -53,9 +53,9 @@ warnings: + <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command as <tt>root</tt>: {{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}} - <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> @@ -17417,55 +12453,64 @@ index b0904920..89b83462 100644 </ul> diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/file_groupowner_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/file_groupowner_grub2_cfg/rule.yml -index 85ef10db..fe45409c 100644 +index ac36a68b..0979c2a8 100644 --- a/linux_os/guide/system/bootloader-grub2/non-uefi/file_groupowner_grub2_cfg/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/non-uefi/file_groupowner_grub2_cfg/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 - title: 'Verify /boot/grub2/grub.cfg Group Ownership' + title: 'Verify {{{ grub2_boot_path }}}/grub.cfg Group Ownership' diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/file_owner_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/file_owner_grub2_cfg/rule.yml -index dcd00e18..577d4bd1 100644 +index 520d00ec..ecf99a1b 100644 --- a/linux_os/guide/system/bootloader-grub2/non-uefi/file_owner_grub2_cfg/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/non-uefi/file_owner_grub2_cfg/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 - title: 'Verify /boot/grub2/grub.cfg User Ownership' + title: 'Verify {{{ grub2_boot_path }}}/grub.cfg User Ownership' diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/file_permissions_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/file_permissions_grub2_cfg/rule.yml -index bd4f85bc..4a017d02 100644 +index 9df7baf2..9943577a 100644 --- a/linux_os/guide/system/bootloader-grub2/non-uefi/file_permissions_grub2_cfg/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/non-uefi/file_permissions_grub2_cfg/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 - title: 'Verify /boot/grub2/grub.cfg Permissions' + title: 'Verify {{{ grub2_boot_path }}}/grub.cfg Permissions' diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml -index 4b04936e..e53066bd 100644 +index bb2f1bae..728adcca 100644 --- a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_admin_username/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Set the Boot Loader Admin Username to a Non-Default Value' +@@ -49,7 +49,7 @@ references: + srg: SRG-OS-000080-GPOS-00048 + stigid@ol7: OL07-00-010480 + stigid@rhel7: RHEL-07-010480 +- stigid@rhel8: RHEL-08-010149 ++ stigid@almalinux8: RHEL-08-010149 + + ocil_clause: 'it does not' + diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_no_removeable_media/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_no_removeable_media/rule.yml -index 5b2846ec..94a9a1cd 100644 +index c2b738aa..4bbff3f3 100644 --- a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_no_removeable_media/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_no_removeable_media/rule.yml @@ -1,6 +1,6 @@ @@ -17477,28 +12522,28 @@ index 5b2846ec..94a9a1cd 100644 title: 'Boot Loader Is Not Installed On Removeable Media' diff --git a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml -index 92129ab7..d064f632 100644 +index 9936aaa6..a7af891e 100644 --- a/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/non-uefi/grub2_password/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Set Boot Loader Password in grub2' -@@ -63,7 +63,7 @@ references: - iso27001-2013: A.18.1.4,A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,14,15,16,18,3,5 - anssi: BP28(R17) +@@ -66,7 +66,7 @@ references: + srg: SRG-OS-000080-GPOS-00048 + stigid@ol7: OL07-00-010482 + stigid@rhel7: RHEL-07-010482 - stigid@rhel8: RHEL-08-010150 + stigid@almalinux8: RHEL-08-010150 - - ocil_clause: 'it does not' - + stigid@sle12: SLES-12-010430 + stigid@sle15: SLES-15-010190 + stigid@ubuntu2004: UBTU-20-010009 diff --git a/linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_grub2_cfg/rule.yml -index 4d9fdf54..a7799d37 100644 +index f44e85a0..96feebbd 100644 --- a/linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_grub2_cfg/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/uefi/file_groupowner_efi_grub2_cfg/rule.yml @@ -1,20 +1,20 @@ @@ -17527,7 +12572,7 @@ index 4d9fdf54..a7799d37 100644 {{%- endif %}} rationale: |- -@@ -39,16 +39,16 @@ references: +@@ -44,16 +44,16 @@ references: ocil_clause: |- {{%- if product == "fedora" %}} @@ -17548,7 +12593,7 @@ index 4d9fdf54..a7799d37 100644 {{%- endif %}} platform: machine -@@ -56,6 +56,6 @@ platform: machine +@@ -61,6 +61,6 @@ platform: machine template: name: file_groupowner vars: @@ -17558,7 +12603,7 @@ index 4d9fdf54..a7799d37 100644 + filepath@fedora: /boot/efi/EFI/almalinux/grub.cfg filegid: '0' diff --git a/linux_os/guide/system/bootloader-grub2/uefi/file_owner_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/file_owner_efi_grub2_cfg/rule.yml -index a9f498ed..f0f979ce 100644 +index a9468d00..b4ee87fe 100644 --- a/linux_os/guide/system/bootloader-grub2/uefi/file_owner_efi_grub2_cfg/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/uefi/file_owner_efi_grub2_cfg/rule.yml @@ -1,20 +1,20 @@ @@ -17587,7 +12632,7 @@ index a9f498ed..f0f979ce 100644 {{%- endif %}} rationale: 'Only root should be able to modify important boot parameters.' -@@ -37,16 +37,16 @@ references: +@@ -42,16 +42,16 @@ references: ocil_clause: |- {{%- if product == "fedora" %}} @@ -17608,7 +12653,7 @@ index a9f498ed..f0f979ce 100644 {{%- endif %}} platform: machine -@@ -54,6 +54,6 @@ platform: machine +@@ -59,6 +59,6 @@ platform: machine template: name: file_owner vars: @@ -17618,14 +12663,14 @@ index a9f498ed..f0f979ce 100644 + filepath@fedora: /boot/efi/EFI/almalinux/grub.cfg fileuid: '0' diff --git a/linux_os/guide/system/bootloader-grub2/uefi/file_permissions_efi_grub2_cfg/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/file_permissions_efi_grub2_cfg/rule.yml -index 1019d9ba..644ae437 100644 +index bc4fdcc7..75c8c2c2 100644 --- a/linux_os/guide/system/bootloader-grub2/uefi/file_permissions_efi_grub2_cfg/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/uefi/file_permissions_efi_grub2_cfg/rule.yml @@ -1,16 +1,16 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Verify the UEFI Boot Loader grub.cfg Permissions' @@ -17643,7 +12688,7 @@ index 1019d9ba..644ae437 100644 {{%- endif %}} rationale: |- -@@ -35,11 +35,11 @@ ocil_clause: 'it does not' +@@ -40,11 +40,11 @@ ocil_clause: 'it does not' ocil: |- {{%- if product == "fedora" %}} @@ -17659,7 +12704,7 @@ index 1019d9ba..644ae437 100644 {{%- endif %}} If properly configured, the output should indicate the following permissions: <tt>-rwx------</tt> -@@ -49,6 +49,6 @@ platform: machine +@@ -54,6 +54,6 @@ platform: machine template: name: file_permissions vars: @@ -17683,18 +12728,18 @@ index 8545e8ab..9583e7fe 100644 <def-group> diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml -index ea5c80f1..bc0067ed 100644 +index 8a98cbdc..6b4af975 100644 --- a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_admin_username/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Set the UEFI Boot Loader Admin Username to a Non-Default Value' -@@ -20,17 +20,10 @@ description: |- +@@ -20,7 +20,7 @@ description: |- Once the superuser account has been added, update the <tt>grub.cfg</tt> file by running: @@ -17703,15 +12748,14 @@ index ea5c80f1..bc0067ed 100644 rationale: |- Having a non-default grub superuser username makes password-guessing attacks less effective. -- {{% if product == "rhel7" %}} -- For more information on how to configure the grub2 superuser account and password, -- please refer to -- <ul> -- <li>{{{ weblink(link="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/ch-working_with_the_grub_2_boot_loader#sec-Protecting_GRUB_2_with_a_Password") }}}</li>. -- </ul> -- {{% endif %}} +@@ -56,7 +56,7 @@ references: + srg: SRG-OS-000080-GPOS-00048 + stigid@ol7: OL07-00-010490 + stigid@rhel7: RHEL-07-010490 +- stigid@rhel8: RHEL-08-010141 ++ stigid@almalinux8: RHEL-08-010141 - severity: low + ocil_clause: 'it does not' diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/oval/shared.xml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/oval/shared.xml index 230aab73..5c728f6b 100644 @@ -17746,19 +12790,19 @@ index 230aab73..5c728f6b 100644 </ind:textfilecontent54_test> <ind:textfilecontent54_object id="object_grub2_uefi_password_grubcfg" version="1"> diff --git a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml -index decb94b9..303cd735 100644 +index cb0d60c3..bda0208e 100644 --- a/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Set the UEFI Boot Loader Password' -@@ -32,7 +32,7 @@ description: |- - {{% if product == "sle12" %}} +@@ -34,7 +34,7 @@ description: |- + {{% elif product in ["sle12", "sle15"] %}} <pre>grub2-mkconfig -o /boot/efi/EFI/sles/grub.cfg</pre> {{% else %}} - <pre>grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre> @@ -17766,18 +12810,18 @@ index decb94b9..303cd735 100644 {{% endif %}} rationale: |- -@@ -67,7 +67,7 @@ references: - iso27001-2013: A.6.1.2,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 11,12,14,15,16,18,3,5 - anssi: BP28(R17) +@@ -71,7 +71,7 @@ references: + srg: SRG-OS-000080-GPOS-00048 + stigid@ol7: OL07-00-010491 + stigid@rhel7: RHEL-07-010491 - stigid@rhel8: RHEL-08-010140 + stigid@almalinux8: RHEL-08-010140 - - ocil_clause: 'it does not' - -@@ -91,7 +91,7 @@ ocil: |- - 916F7AB46E0D.1302284FCCC52CD73BA3671C6C12C26FF50BA873293B24EE2A96EE3B57963E6D7 - 0C83964B473EC8F93B07FE749AA6710269E904A9B08A6BBACB00A2D242AD828</pre> + stigid@sle12: SLES-12-010440 + stigid@sle15: SLES-15-010200 + stigid@ubuntu2004: UBTU-20-010009 +@@ -102,7 +102,7 @@ ocil: |- + The output should contain something similar to: + <pre>password_pbkdf2 root grub.pbkdf2.sha512.10000.MFU48934NJA87HF8NSD34493GDHF84NG</pre> {{% else %}} - <pre>sudo cat /boot/efi/EFI/redhat/user.cfg</pre> + <pre>sudo cat /boot/efi/EFI/almalinux/user.cfg</pre> @@ -17785,7 +12829,7 @@ index decb94b9..303cd735 100644 <pre>GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.C4E08AC72FBFF7E837FD267BFAD7AEB3D42DDC 2C99F2A94DD5E2E75C2DC331B719FE55D9411745F82D1B6CFD9E927D61925F9BBDD1CFAA0080E0 diff --git a/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/oval/shared.xml b/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/oval/shared.xml -index 9ebe7786..c5e4662f 100644 +index 72872d90..57b77cc8 100644 --- a/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/oval/shared.xml +++ b/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/oval/shared.xml @@ -1,7 +1,7 @@ @@ -17799,7 +12843,7 @@ index 9ebe7786..c5e4662f 100644 <def-group> diff --git a/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/rule.yml b/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/rule.yml -index cd1dd721..8fdb9eb6 100644 +index 051dd5b5..f7b08d5b 100644 --- a/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/rule.yml +++ b/linux_os/guide/system/bootloader-grub2/uefi/uefi_no_removeable_media/rule.yml @@ -1,6 +1,6 @@ @@ -17820,14 +12864,14 @@ index cd1dd721..8fdb9eb6 100644 <pre>set root='hd0,msdos1'</pre> <tt>usb0</tt>, <tt>cd</tt>, <tt>fd0</tt>, etc. are some examples of removeable diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml -index c2fb5ba6..96d2f138 100644 +index 483e0cf9..6b3f90d7 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9,ubuntu2004 ++prodtype: rhcos4,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Enable Auditing to Start Prior to the Audit Daemon in zIPL' @@ -17865,26 +12909,26 @@ index 5650cc0a..1ee37320 100644 # Remove audit=1 from all boot entries sed -Ei 's/(^options.*\s)audit=1(.*?)$/\1\2/' /boot/loader/entries/* diff --git a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml -index 6548c352..e5e5f421 100644 +index 6d76e896..05d75257 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_audit_backlog_limit_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9,ubuntu2004 ++prodtype: rhcos4,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Extend Audit Backlog Limit for the Audit Daemon in zIPL' diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml -index c3f032d8..6aae1604 100644 +index 56b634d4..3ad83680 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_bls_entries_only/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9 ++prodtype: rhcos4,rhel8,almalinux8,rhel9 title: 'Ensure all zIPL boot entries are BLS compliant' @@ -17920,24 +12964,15 @@ index 7f2be356..80f8b55f 100644 # reboot = false # strategy = configure # complexity = low -diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh -index 2310ca06..c728aabe 100644 ---- a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh -+++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/bash/shared.sh -@@ -1,3 +1,3 @@ --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 - - /usr/sbin/zipl diff --git a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml -index 13192cd8..a1e32325 100644 +index 6c7e3396..b23d9d8c 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_bootmap_is_up_to_date/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9 ++prodtype: rhcos4,rhel8,almalinux8,rhel9 title: 'Ensure zIPL bootmap is up to date' @@ -17975,50 +13010,50 @@ index 7981ba8c..8bfdce20 100644 touch /etc/zipl.conf diff --git a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml -index 261b227d..122ae022 100644 +index a763429f..a0e5a7ba 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_enable_selinux/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9 ++prodtype: rhcos4,rhel8,almalinux8,rhel9 title: 'Ensure SELinux Not Disabled in zIPL' diff --git a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml -index 42c1c8ae..b28abf5e 100644 +index 0cd61ae2..0d87202c 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_page_poison_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9 ++prodtype: rhcos4,rhel8,almalinux8,rhel9 title: 'Enable page allocator poisoning in zIPL' diff --git a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml -index 2f9b04f7..f02be03d 100644 +index df0f6c3e..0f1501c9 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_slub_debug_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9 ++prodtype: rhcos4,rhel8,almalinux8,rhel9 title: 'Enable SLUB/SLAB allocator poisoning in zIPL' diff --git a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml -index f90a0fb4..add880cd 100644 +index 52b192ff..7a10e35b 100644 --- a/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml +++ b/linux_os/guide/system/bootloader-zipl/zipl_vsyscall_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 +-prodtype: rhcos4,rhel8,rhel9 ++prodtype: rhcos4,rhel8,almalinux8,rhel9 title: 'Disable vsyscalls in zIPL' @@ -18069,26 +13104,127 @@ index bae2c025..e279577c 100644 if ! grep -s "^\s*cron\.\*\s*/var/log/cron$" /etc/rsyslog.conf /etc/rsyslog.d/*.conf; then mkdir -p /etc/rsyslog.d diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/rule.yml -index 5e8f08fd..73792bfa 100644 +index c627f52f..7cbe53cb 100644 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/rule.yml +++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_cron_logging/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Ensure cron Is Logging To Rsyslog' -@@ -36,7 +36,7 @@ references: - iso27001-2013: A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.15.2.1,A.15.2.2 - cis-csc: 1,14,15,16,3,5,6 - ism: 0988,1405 +@@ -37,7 +37,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021100 + stigid@rhel7: RHEL-07-021100 - stigid@rhel8: RHEL-08-030010 + stigid@almalinux8: RHEL-08-030010 ocil_clause: 'cron is not logging to rsyslog' +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml +index 637f9000..5adf93ef 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh +index 71d312f3..6005c2ed 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml +index beaf8ce9..d8a4b01d 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/rule.yml +@@ -25,7 +25,7 @@ references: + disa: CCI-001851 + nist: AU-4(1) + srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 +- stigid@rhel8: RHEL-08-030720 ++ stigid@almalinux8: RHEL-08-030720 + + + ocil_clause: '$ActionSendStreamDriverAuthMode in /etc/rsyslog.conf is not set to x509/name' +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml +index bbd27a00..f8d1d6d5 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh +index 36853d17..6d6132ec 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/bash/shared.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + {{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf", + parameter="\$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ") +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml +index 1bcc3392..cdc0c221 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/rule.yml +@@ -25,7 +25,7 @@ references: + disa: CCI-001851 + nist: AU-4(1) + srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 +- stigid@rhel8: RHEL-08-030710 ++ stigid@almalinux8: RHEL-08-030710 + + ocil_clause: 'rsyslogd ActionSendStreamDriverMode not set to 1' + +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml +index b215daae..457d0150 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh +index 3955346c..b41b8619 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/bash/shared.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + {{{ set_config_file(path="/etc/rsyslog.d/encrypt.conf", + parameter="\$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ") + }}} +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml +index eff85d3f..a64f17da 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/rule.yml +@@ -25,7 +25,7 @@ references: + disa: CCI-001851 + nist: AU-4(1) + srg: SRG-OS-000342-GPOS-00133,SRG-OS-000479-GPOS-00224 +- stigid@rhel8: RHEL-08-030710 ++ stigid@almalinux8: RHEL-08-030710 + + ocil_clause: 'rsyslogd DefaultNetstreamDriver not set to gtls' + diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh index 9e3dd5bc..4f352cd4 100755 --- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_files_groupownership/tests/IncludeConfig_is_other.fail.sh @@ -18396,12 +13532,116 @@ index 89d1e26c..7141e0da 100755 # Check if log file with permissions 0601 in rsyslog.conf fails. +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/ansible/shared.yml +index e0fa3b85..b8e50afb 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/ansible/shared.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = false + # strategy = configure + # complexity = low +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/bash/shared.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/bash/shared.sh +index 5bf1641d..1de75c44 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/bash/shared.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + declare -A REMOTE_METHODS=( ['auth.*']='^.*auth\.\*.*$' ['authpriv.*']='^.*authpriv\.\*.*$' ['daemon.*']='^.*daemon\.\*.*$' ) + +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/rule.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/rule.yml +index 82d8ba5b..478e6e46 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/rule.yml ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8,ubuntu2004 ++prodtype: fedora,rhel8,almalinux8,ubuntu2004 + + title: 'Ensure remote access methods are monitored in Rsyslog' + +@@ -30,7 +30,7 @@ references: + disa: CCI-000067 + nist: AC-17(1) + srg: SRG-OS-000032-GPOS-00013 +- stigid@rhel8: RHEL-08-010070 ++ stigid@almalinux8: RHEL-08-010070 + stigid@ubuntu2004: UBTU-20-010403 + + ocil_clause: 'remote access methods are not logging to rsyslog' +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/no_remote_methods.fail.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/no_remote_methods.fail.sh +index aa1c190f..ddcd133c 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/no_remote_methods.fail.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/no_remote_methods.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + declare -A REMOTE_METHODS=( ['auth.*']='^.*auth\.\*.*$' ['authpriv.*']='^.*authpriv\.\*.*$' ['daemon.*']='^.*daemon\.\*.*$' ) + RSYSLOG_CONF='/etc/rsyslog.conf' +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_multiple_configs.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_multiple_configs.pass.sh +index e36e21ad..71903c8b 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_multiple_configs.pass.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_multiple_configs.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + declare -A REMOTE_METHODS=( ['auth.*']='^.*auth\.\*.*$' ['authpriv.*']='^.*authpriv\.\*.*$' ['daemon.*']='^.*daemon\.\*.*$' ) + RSYSLOG_CONF='/etc/rsyslog.conf' +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_conf.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_conf.pass.sh +index 86371c46..2e418bfe 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_conf.pass.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_conf.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + declare -A REMOTE_METHODS=( ['auth.*']='^.*auth\.\*.*$' ['authpriv.*']='^.*authpriv\.\*.*$' ['daemon.*']='^.*daemon\.\*.*$' ) + RSYSLOG_CONF='/etc/rsyslog.conf' +diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_d.pass.sh b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_d.pass.sh +index 46ea1de0..4aa7b2d6 100644 +--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_d.pass.sh ++++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_remote_access_monitoring/tests/remote_method_set_rsyslog_d.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + declare -A REMOTE_METHODS=( ['auth.*']='^.*auth\.\*.*$' ['authpriv.*']='^.*authpriv\.\*.*$' ['daemon.*']='^.*daemon\.\*.*$' ) + RSYSLOG_CONF='/etc/rsyslog.conf' +diff --git a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/kubernetes/shared.yml b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/kubernetes/shared.yml +index 859ea93e..9b9ea07f 100644 +--- a/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/kubernetes/shared.yml ++++ b/linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/kubernetes/shared.yml +@@ -1,5 +1,5 @@ + --- +-# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_rhcos ++# platform = multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_rhcos + # reboot = true + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml -index 4e969a30..42909f3f 100644 +index 14559afc..b4a65f7e 100644 --- a/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml +++ b/linux_os/guide/system/logging/package_rsyslog-gnutls_installed/rule.yml -@@ -18,7 +18,7 @@ identifiers: - references: +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 + + title: 'Ensure rsyslog-gnutls is installed' + +@@ -23,7 +23,7 @@ references: + disa: CCI-000366 ospp: FTP_ITC_EXT.1.1 srg: SRG-OS-000480-GPOS-00227,SRG-OS-000120-GPOS-00061 - stigid@rhel8: RHEL-08-030680 @@ -18410,37 +13650,37 @@ index 4e969a30..42909f3f 100644 ocil_clause: 'the package is not installed' diff --git a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml -index 7fb9ee40..db5f7ef1 100644 +index cd66059c..59cfba27 100644 --- a/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml +++ b/linux_os/guide/system/logging/package_rsyslog_installed/rule.yml -@@ -28,7 +28,7 @@ references: - cobit5: APO11.04,BAI03.05,DSS05.04,DSS05.07,MEA02.01 - cis-csc: 1,14,15,16,3,5,6 - srg: SRG-OS-000479-GPOS-00224,SRG-OS-000051-GPOS-00024 +@@ -30,7 +30,7 @@ references: + nist: CM-6(a) + nist-csf: PR.PT-1 + srg: SRG-OS-000479-GPOS-00224,SRG-OS-000051-GPOS-00024,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-030670 + stigid@almalinux8: RHEL-08-030670 ocil_clause: 'the package is not installed' diff --git a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml -index fe06b1c2..0bd7b616 100644 +index 2a9e1a9f..de765d95 100644 --- a/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml +++ b/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_nolisten/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server' diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/ansible/shared.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/ansible/shared.yml -index 407e1be3..c85cc237 100644 +index 74270442..8e8c6fdb 100644 --- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/ansible/shared.yml +++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,multi_platform_sle # reboot = false # strategy = restrict # complexity = low @@ -18455,88 +13695,97 @@ index 836f0af2..78aba4d8 100644 . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml -index 8d8be95f..2b4c49b4 100644 +index 5290a921..5852f5c5 100644 --- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml +++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_loghost/rule.yml -@@ -58,7 +58,7 @@ references: - cobit5: APO11.04,APO13.01,BAI03.05,BAI04.04,DSS05.04,DSS05.07,MEA02.01 - cis-csc: 1,13,14,15,16,2,3,5,6 - ism: 0988,1405 +@@ -62,7 +62,7 @@ references: + srg: SRG-OS-000479-GPOS-00224,SRG-OS-000480-GPOS-00227,SRG-OS-000342-GPOS-00133 + stigid@ol7: OL07-00-031000 + stigid@rhel7: RHEL-07-031000 - stigid@rhel8: RHEL-08-030690 + stigid@almalinux8: RHEL-08-030690 - - ocil_clause: 'none of these are present' - + stigid@sle12: SLES-12-030340 + stigid@sle15: SLES-15-010580 + vmmsrg: SRG-OS-000032-VMM-000130 diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml -index e8c2ea6f..7fb84760 100644 +index 9f30722a..349e61a8 100644 --- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml +++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8 -+prodtype: fedora,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 title: 'Configure TLS for rsyslog remote logging' diff --git a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml -index d08374a8..2c84c098 100644 +index 0765a5db..ea7e8f37 100644 --- a/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml +++ b/linux_os/guide/system/logging/rsyslog_sending_messages/rsyslog_remote_tls_cacert/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8 -+prodtype: fedora,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 title: 'Configure CA certificate for rsyslog remote logging' diff --git a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml -index a87d19fc..14374bb0 100644 +index 04349e68..ab481838 100644 --- a/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml +++ b/linux_os/guide/system/logging/service_rsyslog_enabled/rule.yml -@@ -29,7 +29,7 @@ references: - cobit5: APO10.01,APO10.03,APO10.04,APO10.05,APO11.04,APO13.01,BAI03.05,BAI04.04,DSS01.03,DSS03.05,DSS05.02,DSS05.04,DSS05.05,DSS05.07,MEA01.01,MEA01.02,MEA01.03,MEA01.04,MEA01.05,MEA02.01 - cis-csc: 1,12,13,14,15,16,2,3,5,6,7,8,9 - cis@ubuntu2004: 4.2.1.2 +@@ -32,7 +32,7 @@ references: + nist: CM-6(a),AU-4(1) + nist-csf: DE.CM-1,DE.CM-3,DE.CM-7,ID.SC-4,PR.DS-4,PR.PT-1 + srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010561 + stigid@almalinux8: RHEL-08-010561 - srg: SRG-OS-000480-GPOS-00227 + stigid@ubuntu2004: UBTU-20-010432 - ocil: '{{{ ocil_service_enabled(service="rsyslog") }}}' + ocil: |- diff --git a/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml b/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml -index 7aea04c6..00a21cfa 100644 +index 25c930f8..9408fd6a 100644 --- a/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml +++ b/linux_os/guide/system/network/network-firewalld/firewalld_activation/package_firewalld_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Install firewalld Package' +@@ -26,7 +26,7 @@ references: + nist: CM-6(a) + nist@sle15: CM-7,CM-7.1(iii),CM-7(b),AC-17(1) + srg: SRG-OS-000096-GPOS-00050,SRG-OS-000297-GPOS-00115,SRG-OS-000298-GPOS-00116,SRG-OS-000480-GPOS-00227,SRG-OS-000480-GPOS-00232 +- stigid@rhel8: RHEL-08-040100 ++ stigid@almalinux8: RHEL-08-040100 + stigid@sle15: SLES-15-010220 + + ocil_clause: 'the package is not installed' diff --git a/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml b/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml -index 818edc3c..fc684c39 100644 +index 42849bdd..36ccd8b3 100644 --- a/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml +++ b/linux_os/guide/system/network/network-firewalld/firewalld_activation/service_firewalld_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Verify firewalld Enabled' -@@ -34,7 +34,7 @@ references: - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 - cis@sle15: 3.5.1.4 -- stigid@rhel8: RHEL-08-040100 -+ stigid@almalinux8: RHEL-08-040100 - - ocil: '{{{ ocil_service_enabled(service="firewalld") }}}' +@@ -40,7 +40,7 @@ references: + srg: SRG-OS-000096-GPOS-00050,SRG-OS-000297-GPOS-00115,SRG-OS-000480-GPOS-00227,SRG-OS-000480-GPOS-00231,SRG-OS-000480-GPOS-00232 + stigid@ol7: OL07-00-040520 + stigid@rhel7: RHEL-07-040520 +- stigid@rhel8: RHEL-08-040101 ++ stigid@almalinux8: RHEL-08-040101 + stigid@sle15: SLES-15-010220 + ocil: |- diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/bash/shared.sh b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/bash/shared.sh index 0a698d3c..951e20e6 100644 --- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/bash/shared.sh @@ -18548,26 +13797,26 @@ index 0a698d3c..951e20e6 100644 # complexity = low # strategy = configure diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml -index 04c7cebc..1e0c330c 100644 +index 8e49a685..47fb488d 100644 --- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml +++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Configure the Firewalld Ports' @@ -53,7 +53,7 @@ references: - iso27001-2013: A.11.2.6,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.2.1,A.6.2.2,A.9.1.2 - cis-csc: 11,12,14,15,3,8,9 - ism: "1416" + srg: SRG-OS-000096-GPOS-00050,SRG-OS-000297-GPOS-00115 + stigid@ol7: OL07-00-040100 + stigid@rhel7: RHEL-07-040100 - stigid@rhel8: RHEL-08-040030 + stigid@almalinux8: RHEL-08-040030 + vmmsrg: SRG-OS-000096-VMM-000490,SRG-OS-000480-VMM-002000 ocil_clause: 'the default rules are not configured' - diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_rate_limiting/ansible/shared.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_rate_limiting/ansible/shared.yml index 787eb697..b507337f 100644 --- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/configure_firewalld_rate_limiting/ansible/shared.yml @@ -18579,50 +13828,50 @@ index 787eb697..b507337f 100644 # strategy = configure # complexity = low diff --git a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml -index 60520b21..168a29c4 100644 +index f4d78fb7..41f0d78d 100644 --- a/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml +++ b/linux_os/guide/system/network/network-firewalld/ruleset_modifications/set_firewalld_default_zone/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Set Default firewalld Zone for Incoming Packets' diff --git a/linux_os/guide/system/network/network-ipsec/libreswan_approved_tunnels/rule.yml b/linux_os/guide/system/network/network-ipsec/libreswan_approved_tunnels/rule.yml -index a72513b7..36b41e1b 100644 +index 8d93bae8..08c7a78e 100644 --- a/linux_os/guide/system/network/network-ipsec/libreswan_approved_tunnels/rule.yml +++ b/linux_os/guide/system/network/network-ipsec/libreswan_approved_tunnels/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Verify Any Configured IPSec Tunnel Connections' diff --git a/linux_os/guide/system/network/network-ipsec/package_libreswan_installed/rule.yml b/linux_os/guide/system/network/network-ipsec/package_libreswan_installed/rule.yml -index d5d4b9bc..025ac83a 100644 +index e89f9e0a..c9984c96 100644 --- a/linux_os/guide/system/network/network-ipsec/package_libreswan_installed/rule.yml +++ b/linux_os/guide/system/network/network-ipsec/package_libreswan_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install libreswan Package' diff --git a/linux_os/guide/system/network/network-iptables/package_iptables_installed/rule.yml b/linux_os/guide/system/network/network-iptables/package_iptables_installed/rule.yml -index 15b66f5d..861426d8 100644 +index 9f0b8595..970f04af 100644 --- a/linux_os/guide/system/network/network-iptables/package_iptables_installed/rule.yml +++ b/linux_os/guide/system/network/network-iptables/package_iptables_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu2004 title: 'Install iptables Package' @@ -18673,313 +13922,355 @@ index aac0fae4..ca69e4d4 100644 title: 'Manually Assign Global IPv6 Address' diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/kubernetes/shared.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/kubernetes/shared.yml -index f3b2aeea..2080559c 100644 +index 87306fed..88e2884b 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/rule.yml -index 0b38e2f4..f24a7236 100644 +index 25b5c181..cfed7838 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Configure Accepting Router Advertisements on All IPv6 Interfaces' -@@ -27,7 +27,7 @@ references: - cis-csc: 11,14,3,9 +@@ -31,7 +31,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a) + nist-csf: PR.IP-1,PR.PT-3 srg: SRG-OS-000480-GPOS-00227 - cis@sle15: 3.3.9 - stigid@rhel8: RHEL-08-040261 + stigid@almalinux8: RHEL-08-040261 {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv6.conf.all.accept_ra", value="0") }}} diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_defrtr/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_defrtr/rule.yml -index 5b5bfc96..0de99319 100644 +index 979201fc..07de17fc 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_defrtr/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_defrtr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_pinfo/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_pinfo/rule.yml -index d75989fc..987cdee8 100644 +index d430df13..544c2b3f 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_pinfo/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_pinfo/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_rtr_pref/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_rtr_pref/rule.yml -index 09d263cf..a6fccd67 100644 +index 8c009414..6b7852da 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_rtr_pref/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_ra_rtr_pref/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/kubernetes/shared.yml -index ede503c0..56a06d0a 100644 +index 8792fc66..2c7c4b02 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/rule.yml -index 9253f723..30e4fd3f 100644 +index a00665a2..86192222 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Disable Accepting ICMP Redirects for All IPv6 Interfaces' +@@ -33,7 +33,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),CM-6(b),CM-6.1(iv) + nist-csf: PR.IP-1,PR.PT-3 + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-040280 ++ stigid@almalinux8: RHEL-08-040280 + stigid@sle12: SLES-12-030363 + stigid@sle15: SLES-15-040341 + diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/kubernetes/shared.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/kubernetes/shared.yml -index 6d05fa28..2e910c46 100644 +index e222b1c8..85b92ce9 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml -index 8767a522..746b24fa 100644 +index dd6762af..a712db98 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_accept_source_route/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces' +@@ -43,7 +43,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040830 + stigid@rhel7: RHEL-07-040830 +- stigid@rhel8: RHEL-08-040240 ++ stigid@almalinux8: RHEL-08-040240 + stigid@sle12: SLES-12-030361 + stigid@sle15: SLES-15-040310 + diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_autoconf/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_autoconf/rule.yml -index e7b9455e..fbef57d3 100644 +index d0b011dd..4716dde4 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_autoconf/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_autoconf/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Auto Configuration on All IPv6 Interfaces diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_forwarding/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_forwarding/rule.yml -index 2944e5f4..97b22b95 100644 +index 0ec0a894..8de42a0d 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_forwarding/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_forwarding/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Disable Kernel Parameter for IPv6 Forwarding' diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_max_addresses/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_max_addresses/rule.yml -index 6621abe5..15322ec5 100644 +index 038d4b2e..e832c9bc 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_max_addresses/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_max_addresses/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_router_solicitations/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_router_solicitations/rule.yml -index d9841fef..976f6de5 100644 +index 697718ee..01b7652c 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_router_solicitations/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_all_router_solicitations/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Configure Denying Router Solicitations on All IPv6 Interfaces' diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/kubernetes/shared.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/kubernetes/shared.yml -index 4ec63bd9..87536abe 100644 +index 4ed2c480..f59b6d7c 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/rule.yml -index 167fb59f..c49d18c2 100644 +index 987a5964..56027dac 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Disable Accepting Router Advertisements on all IPv6 Interfaces by Default' -@@ -27,7 +27,7 @@ references: - cis-csc: 11,14,3,9 +@@ -31,7 +31,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a) + nist-csf: PR.IP-1,PR.PT-3 srg: SRG-OS-000480-GPOS-00227 - cis@sle15: 3.3.9 - stigid@rhel8: RHEL-08-040262 + stigid@almalinux8: RHEL-08-040262 {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv6.conf.default.accept_ra", value="0") }}} diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_defrtr/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_defrtr/rule.yml -index 5cf98305..1aacc692 100644 +index 2da8c426..4d247fed 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_defrtr/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_defrtr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Accepting Default Router in Router Advertisements on All IPv6 Interfaces By Default diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_pinfo/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_pinfo/rule.yml -index d7dad19f..9e1944ef 100644 +index 2865601d..2b7a44e8 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_pinfo/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_pinfo/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Accepting Prefix Information in Router Advertisements on All IPv6 Interfaces By Default diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_rtr_pref/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_rtr_pref/rule.yml -index b6ee0610..fe540252 100644 +index 6de9820b..e9f91a67 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_rtr_pref/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_ra_rtr_pref/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Accepting Router Preference in Router Advertisements on All IPv6 Interfaces By Default diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/kubernetes/shared.yml -index 849b0d45..c2369642 100644 +index 845b013e..063776b8 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/rule.yml -index 970db38b..280af55c 100644 +index cbab4262..90921aca 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces' +@@ -35,7 +35,7 @@ references: + nist@sle12: CM-6(b),CM-6.1(iv) + nist@sle15: CM-6(b),CM-6.1(iv) + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-040210 ++ stigid@almalinux8: RHEL-08-040210 + stigid@sle12: SLES-12-030401 + stigid@sle15: SLES-15-040350 + diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/kubernetes/shared.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/kubernetes/shared.yml -index 6a26a8fb..b13d3aae 100644 +index e2951d84..0335df12 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/rule.yml -index af6be950..2a0a07a0 100644 +index 4cf3114d..73e9ff4a 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_accept_source_route/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default' +@@ -41,7 +41,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),CM-6(b),CM-6.1(iv) + nist-csf: DE.AE-1,ID.AM-3,PR.AC-5,PR.DS-5,PR.PT-4 + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-040250 ++ stigid@almalinux8: RHEL-08-040250 + stigid@sle12: SLES-12-030362 + stigid@sle15: SLES-15-040321 + diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_autoconf/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_autoconf/rule.yml -index af2322b3..c2fc7e4b 100644 +index 95a023ef..b0e039fc 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_autoconf/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_autoconf/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Auto Configuration on All IPv6 Interfaces By Default diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_max_addresses/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_max_addresses/rule.yml -index 32ade229..f0492b1b 100644 +index d7795727..f7627692 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_max_addresses/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_max_addresses/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: Configure Maximum Number of Autoconfigured Addresses on All IPv6 Interfaces By Default diff --git a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_router_solicitations/rule.yml b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_router_solicitations/rule.yml -index c2871e00..38b03173 100644 +index d4eeebf7..16f3c9b5 100644 --- a/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_router_solicitations/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/configuring_ipv6/sysctl_net_ipv6_conf_default_router_solicitations/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Configure Denying Router Solicitations on All IPv6 Interfaces By Default' diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml -index aa60680e..06fa8075 100644 +index dae640f3..f3856b72 100644 --- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/grub2_ipv6_disable_argument/rule.yml @@ -1,6 +1,6 @@ @@ -18991,7 +14282,7 @@ index aa60680e..06fa8075 100644 title: 'Ensure IPv6 is disabled through kernel boot parameter' @@ -81,9 +81,9 @@ warnings: - <pre>sudo grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> + <pre>sudo grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command: {{% if product in ["rhel7", "ol7", "rhel8", "ol8"] %}} - <pre>sudo grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> @@ -19034,22 +14325,6 @@ index db339c35..38d2f0d6 100644 # Break the ipv6.disable argument in kernel command line in /boot/grub2/grubenv file="/boot/grub2/grubenv" -diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/bash/shared.sh b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/bash/shared.sh -index a7766ecf..f309a1a9 100644 ---- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/bash/shared.sh -+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/bash/shared.sh -@@ -3,10 +3,8 @@ - # Prevent the IPv6 kernel module (ipv6) from loading the IPv6 networking stack - echo "options ipv6 disable=1" > /etc/modprobe.d/ipv6.conf - --# Since according to: https://access.redhat.com/solutions/72733 - # "ipv6 disable=1" options doesn't always disable the IPv6 networking stack from --# loading, instruct also sysctl configuration to disable IPv6 according to: --# https://access.redhat.com/solutions/8709#rhel6disable -+# loading - - declare -a IPV6_SETTINGS=("net.ipv6.conf.all.disable_ipv6" "net.ipv6.conf.default.disable_ipv6") - diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/network_ipv6_disable_interfaces/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/network_ipv6_disable_interfaces/rule.yml index 86299ffb..672d504a 100644 --- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/network_ipv6_disable_interfaces/rule.yml @@ -19073,7 +14348,7 @@ index 48e71c26..5a54df85 100644 # Drop 'tcp6' and 'udp6' entries from /etc/netconfig to prevent RPC # services for NFSv4 from attempting to start IPv6 network listeners diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/network_ipv6_disable_rpc/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/network_ipv6_disable_rpc/rule.yml -index 489bfe6a..ae8202be 100644 +index 2d0ac285..5d39af15 100644 --- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/network_ipv6_disable_rpc/rule.yml +++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/network_ipv6_disable_rpc/rule.yml @@ -1,6 +1,6 @@ @@ -19084,127 +14359,119 @@ index 489bfe6a..ae8202be 100644 title: 'Disable Support for RPC IPv6' -diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/sysctl_net_ipv6_conf_all_disable_ipv6/rule.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/sysctl_net_ipv6_conf_all_disable_ipv6/rule.yml -index ed9b0970..d924e682 100644 ---- a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/sysctl_net_ipv6_conf_all_disable_ipv6/rule.yml -+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/sysctl_net_ipv6_conf_all_disable_ipv6/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 - - title: 'Disable IPv6 Networking Support Automatic Loading' - diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/kubernetes/shared.yml -index 53eed93a..d7882075 100644 +index 6bb6de13..1f0664a0 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml -index ffbc4522..1b4e7ff4 100644 +index 72604219..8de28223 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Accepting ICMP Redirects for All IPv4 Interfaces' -@@ -41,7 +41,7 @@ references: - iso27001-2013: A.12.1.2,A.12.1.3,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.17.2.1,A.9.1.2 - cis-csc: 1,11,12,13,14,15,16,2,3,7,8,9 - cis@sle15: 3.3.2 -- stigid@rhel8: RHEL-08-040280 -+ stigid@almalinux8: RHEL-08-040280 - - {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.conf.all.accept_redirects", value="0") }}} +@@ -44,7 +44,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040641 + stigid@rhel7: RHEL-07-040641 +- stigid@rhel8: RHEL-08-040279 ++ stigid@almalinux8: RHEL-08-040279 + stigid@sle12: SLES-12-030390 + stigid@sle15: SLES-15-040330 diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/kubernetes/shared.yml -index 9aa09b26..25027ce5 100644 +index b3d72bb4..b89b8a35 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml -index 4bb38a2e..f953069f 100644 +index f92772eb..b9d6c47f 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_accept_source_route/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces' -@@ -41,7 +41,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.1.3,A.12.5.1,A.12.6.2,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.17.2.1,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,2,3,4,6,7,8,9 - cis@sle15: 3.3.1 -- stigid@rhel8: RHEL-08-040240 -+ stigid@almalinux8: RHEL-08-040240 - - {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.conf.all.accept_source_route", value="0") }}} +@@ -45,7 +45,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040610 + stigid@rhel7: RHEL-07-040610 +- stigid@rhel8: RHEL-08-040239 ++ stigid@almalinux8: RHEL-08-040239 + stigid@sle12: SLES-12-030360 + stigid@sle15: SLES-15-040300 diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/kubernetes/shared.yml -index 0747c89c..b9c43ab2 100644 +index 70e767cc..fbe1a27a 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/rule.yml -index 876186b1..ab045b1e 100644 +index 9e12c3be..04a02b4b 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_log_martians/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/kubernetes/shared.yml -index c29abffc..cfa071f5 100644 +index c64da37a..08535e5a 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml -index 3d1dfb6e..162db994 100644 +index 65475174..c76045ae 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_rp_filter/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces' -@@ -36,7 +36,7 @@ references: +@@ -39,7 +39,7 @@ references: srg: SRG-OS-000480-GPOS-00227 - cis@sle15: 3.3.7 + stigid@ol7: OL07-00-040611 stigid@rhel7: RHEL-07-040611 - stigid@rhel8: RHEL-08-040285 + stigid@almalinux8: RHEL-08-040285 @@ -19212,364 +14479,385 @@ index 3d1dfb6e..162db994 100644 {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.conf.all.rp_filter", value="1") }}} diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/kubernetes/shared.yml -index 8a150f8e..a5514212 100644 +index 8b075d55..0dd17a34 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/rule.yml -index 5d71eb2f..4474385b 100644 +index 848212c7..e3f75c97 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_all_secure_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/kubernetes/shared.yml -index 31f042ba..797d6520 100644 +index 2bfbd9e4..8ea37100 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml -index 4486a92e..4e91a1fb 100644 +index bee6c117..da0c1f33 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces' -@@ -41,7 +41,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.1.3,A.12.5.1,A.12.6.2,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.17.2.1,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,2,3,4,6,7,8,9 - cis@sle15: 3.3.3 -- stigid@rhel8: RHEL-08-040210 -+ stigid@almalinux8: RHEL-08-040210 - - {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.conf.default.accept_redirects", value="0") }}} +@@ -43,7 +43,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040640 + stigid@rhel7: RHEL-07-040640 +- stigid@rhel8: RHEL-08-040209 ++ stigid@almalinux8: RHEL-08-040209 + stigid@sle12: SLES-12-030400 + stigid@sle15: SLES-15-040340 diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/kubernetes/shared.yml -index 8262ae83..4ab5cba1 100644 +index aa7d1562..08668d03 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml -index f7ee2e98..e9d832ad 100644 +index b1e7f247..85712b15 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_accept_source_route/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default' +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040620 + stigid@rhel7: RHEL-07-040620 +- stigid@rhel8: RHEL-08-040249 ++ stigid@almalinux8: RHEL-08-040249 + stigid@sle12: SLES-12-030370 + stigid@sle15: SLES-15-040320 + diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/kubernetes/shared.yml -index 52d0de9a..834b1b95 100644 +index 3a60ab17..728ddb81 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/rule.yml -index f28664d9..ad3e3ae1 100644 +index 178da20d..9aab00f9 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_log_martians/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/kubernetes/shared.yml -index 06defef8..e2674f36 100644 +index b6e53de3..0b652c7c 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/rule.yml -index 86240083..88d3b04a 100644 +index 27d83ac0..b8f91445 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_rp_filter/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/kubernetes/shared.yml -index bdcc7bb6..123b4ade 100644 +index aeb67c4e..f47a8ab6 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/rule.yml -index 022a67d1..34637b5a 100644 +index 3adb5b6f..1a97fded 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_conf_default_secure_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Configure Kernel Parameter for Accepting Secure Redirects By Default' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/kubernetes/shared.yml -index 83baebf3..f19e3aa9 100644 +index 52d74441..08c8c256 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/rule.yml -index f1c4947d..b105ca20 100644 +index 3a998d31..ee20d599 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_echo_ignore_broadcasts/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces' -@@ -38,7 +38,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.1.3,A.12.5.1,A.12.6.2,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.17.2.1,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,2,3,4,6,7,8,9 - cis@sle15: 3.3.5 +@@ -41,7 +41,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040630 + stigid@rhel7: RHEL-07-040630 - stigid@rhel8: RHEL-08-040230 + stigid@almalinux8: RHEL-08-040230 + stigid@sle12: SLES-12-030380 {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.icmp_echo_ignore_broadcasts", value="1") }}} - diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/kubernetes/shared.yml -index 3ac87232..08fb5408 100644 +index 9e3a85af..d4f4d31c 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/rule.yml -index 730ba048..77a410a6 100644 +index f7f5d3c4..0107424b 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_icmp_ignore_bogus_error_responses/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_ip_local_port_range/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_ip_local_port_range/rule.yml -index e38ecebc..f898962c 100644 +index 84bb9162..293a5c85 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_ip_local_port_range/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_ip_local_port_range/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Set Kernel Parameter to Increase Local Port Range' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_invalid_ratelimit/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_invalid_ratelimit/rule.yml -index e68faf00..55a3f222 100644 +index 552b2138..f30fc8cb 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_invalid_ratelimit/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_invalid_ratelimit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,sle15,wrlinux1019 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,sle15,wrlinux1019 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,wrlinux1019 title: 'Configure Kernel to Rate Limit Sending of Duplicate TCP Acknowledgments' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_rfc1337/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_rfc1337/rule.yml -index 7843c189..4eeb57ff 100644 +index b70279f6..d07baa1e 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_rfc1337/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_rfc1337/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Enable Kernel Parameter to Use TCP RFC 1337 on IPv4 Interfaces' diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/kubernetes/shared.yml -index b063545e..0d2f8f4e 100644 +index 0c8dae78..a26df0c5 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/rule.yml -index 7989394c..6c852621 100644 +index 8f557dce..bd4cb580 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_and_router_parameters/sysctl_net_ipv4_tcp_syncookies/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Enable Kernel Parameter to Use TCP Syncookies on IPv4 Interfaces' diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/kubernetes/shared.yml -index 7e936408..26534803 100644 +index ea1db12f..5d8b19f6 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/rule.yml -index 779b9268..ba1b6f78 100644 +index 96be007c..03895e9b 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_all_send_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces' -@@ -39,7 +39,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.1.3,A.12.5.1,A.12.6.2,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.17.2.1,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,2,3,4,6,7,8,9 - cis@sle15: 3.2.2 +@@ -43,7 +43,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040660 + stigid@rhel7: RHEL-07-040660 - stigid@rhel8: RHEL-08-040220 + stigid@almalinux8: RHEL-08-040220 - - {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.conf.all.send_redirects", value="0") }}} + stigid@sle12: SLES-12-030420 + stigid@sle15: SLES-15-040370 diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/kubernetes/shared.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/kubernetes/shared.yml -index 2b3c36d7..3497675f 100644 +index b54e3d12..125464d7 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml -index ade1338b..f530a718 100644 +index bc666de8..03751ecb 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_conf_default_send_redirects/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default' -@@ -39,7 +39,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.1.3,A.12.5.1,A.12.6.2,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.17.2.1,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,2,3,4,6,7,8,9 - cis@sle15: 3.2.2 +@@ -43,7 +43,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040650 + stigid@rhel7: RHEL-07-040650 - stigid@rhel8: RHEL-08-040270 + stigid@almalinux8: RHEL-08-040270 - - {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.ipv4.conf.default.send_redirects", value="0") }}} + stigid@sle12: SLES-12-030410 + stigid@sle15: SLES-15-040360 diff --git a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml -index 6274897a..54a5f33e 100644 +index 950c2ebe..a916d46b 100644 --- a/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml +++ b/linux_os/guide/system/network/network-kernel/network_host_parameters/sysctl_net_ipv4_ip_forward/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,rhcos4,sle12 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,rhcos4,sle12 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces' -@@ -36,7 +36,7 @@ references: - iso27001-2013: A.12.1.2,A.12.1.3,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.17.2.1,A.9.1.2 - cis-csc: 1,11,12,13,14,15,16,2,3,7,8,9 - cis@sle15: 3.2.1 +@@ -41,7 +41,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040740 + stigid@rhel7: RHEL-07-040740 - stigid@rhel8: RHEL-08-040260 + stigid@almalinux8: RHEL-08-040260 + stigid@sle12: SLES-12-030430 + stigid@sle15: SLES-15-040380 - ocil: |- - {{{ ocil_sysctl_option_value(sysctl="net.ipv4.ip_forward", value="0") }}} diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/kubernetes/shared.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/kubernetes/shared.yml -index dea03eed..edc8d08b 100644 +index 7d08edf8..f83779e3 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/rule.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/rule.yml -index caff3aaa..e0ee3175 100644 +index 5c077bb3..3001d34a 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/rule.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_atm_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Disable ATM Support' -@@ -24,7 +24,7 @@ identifiers: - references: +@@ -26,7 +26,7 @@ references: + disa: CCI-000381 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040021 @@ -19578,29 +14866,30 @@ index caff3aaa..e0ee3175 100644 {{{ complete_ocil_entry_module_disable(module="atm") }}} diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/kubernetes/shared.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/kubernetes/shared.yml -index 9149b18d..dc6a23a3 100644 +index 6f5805e5..0ca4ab3b 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/rule.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/rule.yml -index f25e86ab..a191f73f 100644 +index f4d9e23b..df5e95d5 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/rule.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_can_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Disable CAN Support' -@@ -24,7 +24,7 @@ identifiers: - references: +@@ -26,7 +26,7 @@ references: + disa: CCI-000381 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040022 @@ -19609,41 +14898,42 @@ index f25e86ab..a191f73f 100644 {{{ complete_ocil_entry_module_disable(module="can") }}} diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_dccp_disabled/rule.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_dccp_disabled/rule.yml -index d9db321b..efd3bb3d 100644 +index 64f8d808..19109457 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_dccp_disabled/rule.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_dccp_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,sle12 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Disable DCCP Support' diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/kubernetes/shared.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/kubernetes/shared.yml -index b245fd66..d477a75f 100644 +index 61aed859..03f41b72 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/rule.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/rule.yml -index 3c856475..2e7e80a4 100644 +index fb29a467..0d9f26fa 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/rule.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_firewire-core_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Disable IEEE 1394 (FireWire) Support' -@@ -23,7 +23,7 @@ identifiers: - references: +@@ -25,7 +25,7 @@ references: + disa: CCI-000381 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040026 @@ -19652,30 +14942,31 @@ index 3c856475..2e7e80a4 100644 {{{ complete_ocil_entry_module_disable(module="firewire-core") }}} diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/kubernetes/shared.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/kubernetes/shared.yml -index 22d44d76..61faee09 100644 +index 28b8952d..6e3e064a 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/rule.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/rule.yml -index 8db0f115..e6d5d70c 100644 +index ddcb6c2a..95093c78 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/rule.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_sctp_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Disable SCTP Support' -@@ -34,7 +34,7 @@ references: - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.9.1.2 - cis-csc: 11,14,3,9 +@@ -38,7 +38,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a) + nist-csf: PR.IP-1,PR.PT-3 srg: SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040023 + stigid@almalinux8: RHEL-08-040023 @@ -19683,21 +14974,22 @@ index 8db0f115..e6d5d70c 100644 {{{ complete_ocil_entry_module_disable(module="sctp") }}} diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/kubernetes/shared.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/kubernetes/shared.yml -index 209afc09..c494ef11 100644 +index 9761ea78..b98652b4 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/rule.yml b/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/rule.yml -index 5953d5ca..2c0a509f 100644 +index 18e56df4..153d5de7 100644 --- a/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/rule.yml +++ b/linux_os/guide/system/network/network-uncommon/kernel_module_tipc_disabled/rule.yml -@@ -37,7 +37,7 @@ references: - cis-csc: 11,14,3,9 +@@ -41,7 +41,7 @@ references: + nist-csf: PR.IP-1,PR.PT-3 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040024 @@ -19706,38 +14998,39 @@ index 5953d5ca..2c0a509f 100644 {{{ complete_ocil_entry_module_disable(module="tipc") }}} diff --git a/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/kubernetes/shared.yml b/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/kubernetes/shared.yml -index 18187e58..05988c7a 100644 +index 5aaafd12..9d05d0c5 100644 --- a/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/rule.yml b/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/rule.yml -index a6c9b7ed..9e03fd79 100644 +index d277db69..6e6f73db 100644 --- a/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/rule.yml +++ b/linux_os/guide/system/network/network-wireless/wireless_software/kernel_module_bluetooth_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable Bluetooth Kernel Module' -@@ -35,7 +35,7 @@ references: - iso27001-2013: A.11.2.6,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.1.3,A.14.2.2,A.14.2.3,A.14.2.4,A.6.2.1,A.6.2.2,A.9.1.2 - cis-csc: 11,12,14,15,3,8,9 - srg: SRG-OS-000095-GPOS-00049 +@@ -36,7 +36,7 @@ references: + nist: AC-18(a),AC-18(3),CM-7(a),CM-7(b),CM-6(a),MP-7 + nist-csf: PR.AC-3,PR.IP-1,PR.PT-3,PR.PT-4 + srg: SRG-OS-000095-GPOS-00049,SRG-OS-000300-GPOS-00118 - stigid@rhel8: RHEL-08-040111 + stigid@almalinux8: RHEL-08-040111 {{{ complete_ocil_entry_module_disable(module="bluetooth") }}} diff --git a/linux_os/guide/system/network/network-wireless/wireless_software/service_bluetooth_disabled/rule.yml b/linux_os/guide/system/network/network-wireless/wireless_software/service_bluetooth_disabled/rule.yml -index a39d662b..0ae62c2d 100644 +index c7f84c6b..d9482708 100644 --- a/linux_os/guide/system/network/network-wireless/wireless_software/service_bluetooth_disabled/rule.yml +++ b/linux_os/guide/system/network/network-wireless/wireless_software/service_bluetooth_disabled/rule.yml @@ -1,6 +1,6 @@ @@ -19749,7 +15042,7 @@ index a39d662b..0ae62c2d 100644 title: 'Disable Bluetooth Service' diff --git a/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_in_bios/rule.yml b/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_in_bios/rule.yml -index 36507a5d..c5651ad4 100644 +index 6a541594..8c47fed5 100644 --- a/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_in_bios/rule.yml +++ b/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_in_bios/rule.yml @@ -1,6 +1,6 @@ @@ -19761,28 +15054,28 @@ index 36507a5d..c5651ad4 100644 title: 'Disable WiFi or Bluetooth in BIOS' diff --git a/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml b/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml -index d683b2ed..30f79528 100644 +index df5d92d8..559288dd 100644 --- a/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml +++ b/linux_os/guide/system/network/network-wireless/wireless_software/wireless_disable_interfaces/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Deactivate Wireless Network Interfaces' -@@ -45,7 +45,7 @@ references: - cis-csc: 11,12,14,15,3,8,9 - cis@sle15: 3.1.2 - ism: 1315,1319 +@@ -60,7 +60,7 @@ references: + srg: SRG-OS-000299-GPOS-00117,SRG-OS-000300-GPOS-00118,SRG-OS-000424-GPOS-00188,SRG-OS-000481-GPOS-000481 + stigid@ol7: OL07-00-041010 + stigid@rhel7: RHEL-07-041010 - stigid@rhel8: RHEL-08-040110 + stigid@almalinux8: RHEL-08-040110 - - ocil_clause: 'it is not' - + stigid@sle12: SLES-12-030450 + stigid@sle15: SLES-15-010380 + stigid@ubuntu2004: UBTU-20-010455 diff --git a/linux_os/guide/system/network/network_configure_name_resolution/rule.yml b/linux_os/guide/system/network/network_configure_name_resolution/rule.yml -index 8450e29b..ca62146f 100644 +index d3f2eda7..0e99012d 100644 --- a/linux_os/guide/system/network/network_configure_name_resolution/rule.yml +++ b/linux_os/guide/system/network/network_configure_name_resolution/rule.yml @@ -1,6 +1,6 @@ @@ -19794,16 +15087,16 @@ index 8450e29b..ca62146f 100644 title: 'Configure Multiple DNS Servers in /etc/resolv.conf' @@ -39,7 +39,7 @@ references: - cobit5: APO13.01,DSS05.02 - iso27001-2013: A.13.1.1,A.13.2.1,A.14.1.3 - cis-csc: 12,15,8 + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040600 + stigid@rhel7: RHEL-07-040600 - stigid@rhel8: RHEL-08-010680 + stigid@almalinux8: RHEL-08-010680 ocil_clause: 'it does not exist or is not properly configured or less than 2 ''nameserver'' entries exist' diff --git a/linux_os/guide/system/network/network_disable_ddns_interfaces/rule.yml b/linux_os/guide/system/network/network_disable_ddns_interfaces/rule.yml -index 3e286d37..d930a0ca 100644 +index 06a84a9d..dba6f82c 100644 --- a/linux_os/guide/system/network/network_disable_ddns_interfaces/rule.yml +++ b/linux_os/guide/system/network/network_disable_ddns_interfaces/rule.yml @@ -1,6 +1,6 @@ @@ -19823,7 +15116,7 @@ index 6f2e6fa2..ea9c566f 100644 +# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 echo "NOZEROCONF=yes" >> /etc/sysconfig/network diff --git a/linux_os/guide/system/network/network_disable_zeroconf/rule.yml b/linux_os/guide/system/network/network_disable_zeroconf/rule.yml -index 4ad51bb5..d7bdf744 100644 +index 34f6e07e..202330a7 100644 --- a/linux_os/guide/system/network/network_disable_zeroconf/rule.yml +++ b/linux_os/guide/system/network/network_disable_zeroconf/rule.yml @@ -1,6 +1,6 @@ @@ -19855,50 +15148,38 @@ index c3b0b981..cd447e5f 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/network/network_nmcli_permissions/rule.yml b/linux_os/guide/system/network/network_nmcli_permissions/rule.yml -index 3ead3ea6..dc9ddf40 100644 +index 1f0fde55..328daa0d 100644 --- a/linux_os/guide/system/network/network_nmcli_permissions/rule.yml +++ b/linux_os/guide/system/network/network_nmcli_permissions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,rhv4 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Prevent non-Privileged Users from Modifying Network Interfaces using nmcli' diff --git a/linux_os/guide/system/network/network_sniffer_disabled/rule.yml b/linux_os/guide/system/network/network_sniffer_disabled/rule.yml -index 222063ae..30d7aa78 100644 +index 70136627..6ba1a58b 100644 --- a/linux_os/guide/system/network/network_sniffer_disabled/rule.yml +++ b/linux_os/guide/system/network/network_sniffer_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Ensure System is Not Acting as a Network Sniffer' -@@ -42,7 +42,7 @@ references: - cobit5: APO11.06,APO12.06,BAI03.10,BAI09.01,BAI09.02,BAI09.03,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS01.05,DSS04.05,DSS05.02,DSS05.05,DSS06.06 - iso27001-2013: A.11.1.2,A.11.2.4,A.11.2.5,A.11.2.6,A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.16.1.6,A.8.1.1,A.8.1.2,A.9.1.2 - cis-csc: 1,11,14,3,9 +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-040670 + stigid@rhel7: RHEL-07-040670 - stigid@rhel8: RHEL-08-040330 + stigid@almalinux8: RHEL-08-040330 + stigid@sle12: SLES-12-030440 + stigid@sle15: SLES-15-040390 - ocil_clause: 'any network device is in promiscuous mode' - -diff --git a/linux_os/guide/system/network/network_ssl/group.yml b/linux_os/guide/system/network/network_ssl/group.yml -index b641ec61..bcd4f7c4 100644 ---- a/linux_os/guide/system/network/network_ssl/group.yml -+++ b/linux_os/guide/system/network/network_ssl/group.yml -@@ -13,7 +13,3 @@ description: |- - <b>{{{ weblink(link="http://www.openssl.org/docs/") }}}</b>. Information on FIPS validation - of OpenSSL is available at <b>{{{ weblink(link="http://www.openssl.org/docs/fips.html") }}}</b> - and <b>{{{ weblink(link="http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm") }}}</b>. -- {{% if product == "rhel7" %}} -- For information on how to use and implement OpenSSL on Red Hat Enterprise Linux, see -- <b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_OpenSSL.html") }}}</b> -- {{% endif %}} diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/ansible/shared.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/ansible/shared.yml index b49e8cd0..bbbdb90b 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/ansible/shared.yml @@ -19909,37 +15190,37 @@ index b49e8cd0..bbbdb90b 100644 # reboot = false # strategy = restrict # complexity = low -diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/bash/shared.sh b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/bash/shared.sh -index 0e120f96..7826c449 100644 ---- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/bash/shared.sh -+++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/bash/shared.sh -@@ -1,4 +1,4 @@ - #!/bin/bash --# platform = Red Hat Virtualization 4,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Fedora,Oracle Linux 7,Oracle Linux 8,WRLinux 1019 -+# platform = Red Hat Virtualization 4,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Fedora,Oracle Linux 7,Oracle Linux 8,WRLinux 1019 - - find / -not -fstype afs -not -fstype ceph -not -fstype cifs -not -fstype smb3 -not -fstype smbfs -not -fstype sshfs -not -fstype ncpfs -not -fstype ncp -not -fstype nfs -not -fstype nfs4 -not -fstype gfs -not -fstype gfs2 -not -fstype glusterfs -not -fstype gpfs -not -fstype pvfs2 -not -fstype ocfs2 -not -fstype lustre -not -fstype davfs -not -fstype fuse.sshfs -type d -perm -0002 -uid +0 -exec chown root {} \; diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/rule.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/rule.yml -index 02e9ce01..39fce0b2 100644 +index 65e4607a..2e44fecf 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/rule.yml +++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_root_owned/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Ensure All World-Writable Directories Are Owned by root user' -@@ -24,7 +24,7 @@ identifiers: - - references: +@@ -27,7 +27,7 @@ references: anssi: BP28(R40) + disa: CCI-000366 + srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010700 + stigid@almalinux8: RHEL-08-010700 - srg: SRG-OS-000480-GPOS-00227 ocil_clause: 'there is output' + +diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/ansible/shared.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/ansible/shared.yml +index 92ad8c23..526a66e2 100644 +--- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/ansible/shared.yml ++++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/bash/shared.sh b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/bash/shared.sh index e49942d1..426dc99c 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/bash/shared.sh @@ -19951,20 +15232,20 @@ index e49942d1..426dc99c 100644 | xargs -I '{}' find '{}' -xdev -type d \ \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null \ diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml -index 3c9e31b9..a2aa40a0 100644 +index 7a65dde8..1d97b2c8 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml +++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_sticky_bits/rule.yml -@@ -48,7 +48,7 @@ references: - cis-csc: 12,13,14,15,16,18,3,5 - cis@sle15: 1.1.22 - stigid@sle12: SLES-12-010460 +@@ -55,7 +55,7 @@ references: + nist: CM-6(a),AC-6(1) + nist-csf: PR.AC-4,PR.DS-5 + srg: SRG-OS-000138-GPOS-00069 - stigid@rhel8: RHEL-08-010190 + stigid@almalinux8: RHEL-08-010190 - srg: SRG-OS-000138-GPOS-00069 - - ocil_clause: 'any world-writable directories are missing the sticky bit' + stigid@sle12: SLES-12-010460 + stigid@sle15: SLES-15-010300 + stigid@ubuntu2004: UBTU-20-010411 diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml -index e5d22bf7..75dc5df8 100644 +index 62c58d80..66a531b3 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml +++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned/rule.yml @@ -1,6 +1,6 @@ @@ -19976,158 +15257,380 @@ index e5d22bf7..75dc5df8 100644 title: 'Ensure All World-Writable Directories Are Owned by a System Account' diff --git a/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned_group/rule.yml b/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned_group/rule.yml -index 8578172a..3f2dd5b6 100644 +index 21023ce9..b90dc018 100644 --- a/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned_group/rule.yml +++ b/linux_os/guide/system/permissions/files/dir_perms_world_writable_system_owned_group/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12,sle15 title: 'Ensure All World-Writable Directories Are Group Owned by a System Account' +diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml +index 1cde3ded..83ff7bc6 100644 +--- a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml ++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_auditd/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8 ++prodtype: fedora,rhel8,almalinux8 + + title: 'Verify Permissions on /etc/audit/auditd.conf' + +@@ -25,7 +25,7 @@ references: + disa: CCI-000171 + nist: AU-12(b) + srg: SRG-OS-000063-GPOS-00032 +- stigid@rhel8: RHEL-08-030610 ++ stigid@almalinux8: RHEL-08-030610 + + template: + name: file_permissions +diff --git a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml +index 34e1f303..7aa433ce 100644 +--- a/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml ++++ b/linux_os/guide/system/permissions/files/file_permissions_etc_audit_rulesd/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8 ++prodtype: fedora,rhel8,almalinux8 + + title: 'Verify Permissions on /etc/audit/rules.d/*.rules' + +@@ -25,7 +25,7 @@ references: + disa: CCI-000171 + nist: AU-12(b) + srg: SRG-OS-000063-GPOS-00032 +- stigid@rhel8: RHEL-08-030610 ++ stigid@almalinux8: RHEL-08-030610 + + template: + name: file_permissions diff --git a/linux_os/guide/system/permissions/files/file_permissions_unauthorized_sgid/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_unauthorized_sgid/rule.yml -index 6ff491f9..892482a0 100644 +index 7b2eb120..281ebad9 100644 --- a/linux_os/guide/system/permissions/files/file_permissions_unauthorized_sgid/rule.yml +++ b/linux_os/guide/system/permissions/files/file_permissions_unauthorized_sgid/rule.yml @@ -2,7 +2,7 @@ documentation_complete: true title: 'Ensure All SGID Executables Are Authorized' --prodtype: fedora,ol7,ol8,rhel7,rhel8,wrlinux1019,sle15,wrlinux8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,wrlinux1019,sle15,wrlinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle15,wrlinux1019,wrlinux8 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15,wrlinux1019,wrlinux8 description: |- The SGID (set group id) bit should be set only on files that were diff --git a/linux_os/guide/system/permissions/files/file_permissions_unauthorized_suid/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_unauthorized_suid/rule.yml -index a49890c7..d544cf4e 100644 +index 28fce50f..fc4289b4 100644 --- a/linux_os/guide/system/permissions/files/file_permissions_unauthorized_suid/rule.yml +++ b/linux_os/guide/system/permissions/files/file_permissions_unauthorized_suid/rule.yml @@ -2,7 +2,7 @@ documentation_complete: true title: 'Ensure All SUID Executables Are Authorized' --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15,wrlinux1019,wrlinux8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15,wrlinux1019,wrlinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle15,wrlinux1019,wrlinux8 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15,wrlinux1019,wrlinux8 description: |- The SUID (set user id) bit should be set only on files that were diff --git a/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml b/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml -index a9efbdda..10994f97 100644 +index 5cabb944..734bc3e7 100644 --- a/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml +++ b/linux_os/guide/system/permissions/files/file_permissions_ungroupowned/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Ensure All Files Are Owned by a Group' -@@ -42,7 +42,7 @@ references: - cis-csc: 1,11,12,13,14,15,16,18,3,5 - cis@sle15: 6.1.12 - stigid@sle12: SLES-12-010700 +@@ -48,7 +48,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020330 + stigid@rhel7: RHEL-07-020330 - stigid@rhel8: RHEL-08-010790 + stigid@almalinux8: RHEL-08-010790 - - ocil_clause: 'there is output' + stigid@sle12: SLES-12-010700 + stigid@sle15: SLES-15-040410 diff --git a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml -index 6acae65b..b6402961 100644 +index c090e80f..8845a095 100644 --- a/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml +++ b/linux_os/guide/system/permissions/files/no_files_unowned_by_user/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Ensure All Files Are Owned by a User' -@@ -42,7 +42,7 @@ references: - cis-csc: 11,12,13,14,15,16,18,3,5,9 - cis@sle15: 6.1.11 - stigid@sle12: SLES-12-010690 +@@ -49,7 +49,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020320 + stigid@rhel7: RHEL-07-020320 - stigid@rhel8: RHEL-08-010780 + stigid@almalinux8: RHEL-08-010780 + stigid@sle12: SLES-12-010690 + stigid@sle15: SLES-15-040400 - ocil_clause: 'files exist that are not owned by a valid user' +diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml +index 5ddaf9f7..9d227a68 100644 +--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log/rule.yml +@@ -18,7 +18,7 @@ identifiers: + references: + disa: CCI-001314 + srg: SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-010260 ++ stigid@almalinux8: RHEL-08-010260 + stigid@ubuntu2004: UBTU-20-010417 + ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log", group="root") }}}' +diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_messages/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_messages/rule.yml +index 7fa97853..aab0c6f9 100644 +--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_messages/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_groupowner_var_log_messages/rule.yml +@@ -17,7 +17,7 @@ identifiers: + references: + disa: CCI-001314 + srg: SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-010230 ++ stigid@almalinux8: RHEL-08-010230 + + ocil_clause: '{{{ ocil_clause_file_group_owner(file="/var/log/messages", group="root") }}}' + +diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log/rule.yml +index b689df56..1062dd69 100644 +--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log/rule.yml +@@ -18,7 +18,7 @@ identifiers: + references: + disa: CCI-001314 + srg: SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-010250 ++ stigid@almalinux8: RHEL-08-010250 + stigid@ubuntu2004: UBTU-20-010418 + + ocil_clause: '{{{ ocil_clause_file_owner(file="/var/log", owner="root") }}}' +diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_messages/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_messages/rule.yml +index 786cdaaf..c0ee431a 100644 +--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_messages/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_owner_var_log_messages/rule.yml +@@ -17,7 +17,7 @@ identifiers: + references: + disa: CCI-001314 + srg: SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-010220 ++ stigid@almalinux8: RHEL-08-010220 + + ocil_clause: '{{{ ocil_clause_file_owner(file="/var/log/messages", owner="root") }}}' + +diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/rule.yml +index e1933b47..ffafbca1 100644 +--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log/rule.yml +@@ -19,7 +19,7 @@ identifiers: + references: + disa: CCI-001314 + srg: SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-010240 ++ stigid@almalinux8: RHEL-08-010240 + stigid@ubuntu2004: UBTU-20-010419 + + ocil_clause: '{{{ ocil_clause_file_permissions(file="/var/log", perms="drwxr-xr-x") }}}' +diff --git a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_messages/rule.yml b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_messages/rule.yml +index cdd89a98..47650e30 100644 +--- a/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_messages/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_var_log_dir/file_permissions_var_log_messages/rule.yml +@@ -18,7 +18,7 @@ identifiers: + references: + disa: CCI-001314 + srg: SRG-OS-000206-GPOS-00084 +- stigid@rhel8: RHEL-08-010210 ++ stigid@almalinux8: RHEL-08-010210 + + ocil_clause: '{{{ ocil_clause_file_permissions(file="/var/log/messages", perms="-rw-r-----") }}}' + +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml +index f6f2ab48..62306146 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = false + # strategy = restrict + # complexity = medium +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh +index 365b9833..80b141d1 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + find /lib \ + /lib64 \ +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml +index 8c0acc0e..569f6be4 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: sle12,sle15,rhel8,fedora ++prodtype: sle12,sle15,rhel8,almalinux8,fedora + + title: 'Verify that Shared Library Directories Have Root Group Ownership' + +@@ -37,7 +37,7 @@ references: + disa: CCI-001499 + nist: CM-5(6),CM-5(6).1 + srg: SRG-OS-000259-GPOS-00100 +- stigid@rhel8: RHEL-08-010350 ++ stigid@almalinux8: RHEL-08-010350 + stigid@sle12: SLES-12-010876 + stigid@sle15: SLES-15-010356 + +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh +index 50fdb17b..ceca9549 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/all_dirs_ok.pass.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + DIRS="/lib /lib64 /usr/lib /usr/lib64" + for dirPath in $DIRS; do +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh +index 043ad6b2..fed1cb70 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/dir_group_ownership_library_dirs/tests/nobody_group_owned_dir_on_lib.fail.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + DIRS="/lib /lib64 /usr/lib /usr/lib64" + for dirPath in $DIRS; do +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml +index 71682881..f63a3dc2 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = false + # strategy = restrict + # complexity = medium +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh +index 5598e471..05ac5394 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + for SYSCMDFILES in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin + do +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/rule.yml +index cd605363..1717f42c 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_groupownership_system_commands_dirs/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8,sle12,sle15,ubuntu2004 ++prodtype: fedora,rhel8,almalinux8,sle12,sle15,ubuntu2004 + + title: 'Verify that system commands files are group owned by root ' + +@@ -41,7 +41,7 @@ references: + disa: CCI-001499 + nist: CM-5(6),CM-5(6).1 + srg: SRG-OS-000259-GPOS-00100 +- stigid@rhel8: RHEL-08-010320 ++ stigid@almalinux8: RHEL-08-010320 + stigid@sle12: SLES-12-010882 + stigid@sle15: SLES-15-010361 + stigid@ubuntu2004: UBTU-20-010458 diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/ansible/shared.yml -index 5b1e48a3..08a0714c 100644 +index 04178f48..ce116710 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/ansible/shared.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle # reboot = false # strategy = restrict # complexity = medium diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/bash/shared.sh -index e2495d24..88c96d74 100644 +index 5471f360..1a2c2a9f 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/bash/shared.sh +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle find /bin/ \ /usr/bin/ \ /usr/local/bin/ \ diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/rule.yml -index 36943519..4ade86e3 100644 +index 1a13a200..a3d8185c 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/rule.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_binary_dirs/rule.yml -@@ -36,7 +36,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -42,7 +42,7 @@ references: + nist: CM-5(6),CM-5(6).1,CM-6(a),AC-6(1) + nist-csf: PR.AC-4,PR.DS-5 + srg: SRG-OS-000259-GPOS-00100 - stigid@rhel8: RHEL-08-010310 + stigid@almalinux8: RHEL-08-010310 - srg: SRG-OS-000259-GPOS-00100 - - ocil_clause: 'any system executables are found to not be owned by root' + stigid@sle12: SLES-15-010879 + stigid@sle15: SLES-15-010359 + stigid@ubuntu2004: UBTU-20-010457 diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/ansible/shared.yml -index c13c1a03..e535be72 100644 +index de81a370..9f2d834d 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/ansible/shared.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle # reboot = false # strategy = restrict # complexity = medium diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/bash/shared.sh -index d92ff6cb..83ee1ce7 100644 +index c75167d2..dee705ea 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/bash/shared.sh +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle for LIBDIR in /usr/lib /usr/lib64 /lib /lib64 do if [ -d $LIBDIR ] diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml -index c3999716..7b3d19a1 100644 +index dfedd255..8a349c9d 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_ownership_library_dirs/rule.yml -@@ -37,7 +37,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -43,7 +43,7 @@ references: + nist: CM-5(6),CM-5(6).1,CM-6(a),AC-6(1) + nist-csf: PR.AC-4,PR.DS-5 + srg: SRG-OS-000259-GPOS-00100 - stigid@rhel8: RHEL-08-010340 + stigid@almalinux8: RHEL-08-010340 - srg: SRG-OS-000259-GPOS-00100 - - ocil_clause: 'any of these files are not owned by root' + stigid@sle12: SLES-12-010873 + stigid@sle15: SLES-15-010353 + stigid@ubuntu2004: UBTU-20-010428 diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/ansible/shared.yml -index a7d8bc9c..12e69824 100644 +index 33196965..b0572f9d 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/ansible/shared.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle # reboot = false # strategy = restrict # complexity = medium @@ -20142,67 +15645,119 @@ index 5d95c987..6ff7b18a 100644 for dirPath in $DIRS; do find "$dirPath" -perm /022 -exec chmod go-w '{}' \; diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/rule.yml -index efe4a723..8ec19695 100644 +index 80ab758b..aa5f3528 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/rule.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_binary_dirs/rule.yml -@@ -36,7 +36,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -42,7 +42,7 @@ references: + nist: CM-5(6),CM-5(6).1,CM-6(a),AC-6(1) + nist-csf: PR.AC-4,PR.DS-5 + srg: SRG-OS-000259-GPOS-00100 - stigid@rhel8: RHEL-08-010300 + stigid@almalinux8: RHEL-08-010300 - srg: SRG-OS-000259-GPOS-00100 - - ocil_clause: 'any system executables are found to be group or world writable' + stigid@sle12: SLES-12-010878 + stigid@sle15: SLES-15-010358 + stigid@ubuntu2004: UBTU-20-010456 diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/ansible/shared.yml -index a174202b..6d0e04c5 100644 +index cf9eebac..8571c19b 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/ansible/shared.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle # reboot = false # strategy = restrict # complexity = high -diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/bash/shared.sh -index 4db9903a..065ee49b 100644 ---- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/bash/shared.sh -+++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_ol - DIRS="/lib /lib64 /usr/lib /usr/lib64" - for dirPath in $DIRS; do - find "$dirPath" -perm /022 -type f -exec chmod go-w '{}' \; diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml -index e3a067e0..5bc8e025 100644 +index 902d8b5f..b41692d5 100644 --- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml +++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/file_permissions_library_dirs/rule.yml -@@ -37,7 +37,7 @@ references: - cobit5: APO01.06,DSS05.04,DSS05.07,DSS06.02 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -43,7 +43,7 @@ references: + nist: CM-6(a),CM-5(6),CM-5(6).1,AC-6(1) + nist-csf: PR.AC-4,PR.DS-5 + srg: SRG-OS-000259-GPOS-00100 - stigid@rhel8: RHEL-08-010330 + stigid@almalinux8: RHEL-08-010330 - srg: SRG-OS-000259-GPOS-00100 + stigid@sle12: SLES-12-010871 + stigid@sle15: SLES-15-010351 + stigid@ubuntu2004: UBTU-20-010426 +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml +index ab3e85c4..83e1fe32 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = false + # strategy = restrict + # complexity = high +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh +index d5fb8948..da0fb11b 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora - ocil_clause: 'any of these files are group-writable or world-writable' + find /lib \ + /lib64 \ +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml +index 83371b8b..2d6f6b25 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: sle12,sle15,rhel8,fedora ++prodtype: sle12,sle15,rhel8,almalinux8,fedora + + title: |- + Verify the system-wide library files in directories +@@ -41,7 +41,7 @@ references: + disa: CCI-001499 + nist: CM-5(6),CM-5(6).1 + srg: SRG-OS-000259-GPOS-00100 +- stigid@rhel8: RHEL-08-010350 ++ stigid@almalinux8: RHEL-08-010350 + stigid@sle12: SLES-12-010875 + stigid@sle15: SLES-15-010355 + +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh +index a4ae2854..5fc20346 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/correct_group.pass.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + for SYSLIBDIRS in /lib /lib64 /usr/lib /usr/lib64 + do +diff --git a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh +index c96f65b9..2461e35f 100644 +--- a/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh ++++ b/linux_os/guide/system/permissions/files/permissions_within_important_dirs/root_permissions_syslibrary_files/tests/incorrect_group.fail.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = multi_platform_sle,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + + for TESTFILE in /lib/test_me /lib64/test_me /usr/lib/test_me /usr/lib64/test_me + do diff --git a/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/kubernetes/shared.yml b/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/kubernetes/shared.yml -index 1da03eb4..39378e3a 100644 +index b0d59400..4a71eccd 100644 --- a/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/rule.yml b/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/rule.yml -index 9874bb19..ab9d9022 100644 +index b8dcf3a2..4f5d09c8 100644 --- a/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/rule.yml +++ b/linux_os/guide/system/permissions/files/sysctl_fs_protected_hardlinks/rule.yml -@@ -22,7 +22,7 @@ references: - cis: 1.6.1 +@@ -24,7 +24,7 @@ references: + nerc-cip: CIP-003-3 R5.1.1,CIP-003-3 R5.3,CIP-004-3 R2.3,CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,CIP-007-3 R5.1,CIP-007-3 R5.1.1,CIP-007-3 R5.1.2 nist: CM-6(a),AC-6(1) srg: SRG-OS-000324-GPOS-00125 - stigid@rhel8: RHEL-08-010374 @@ -20211,21 +15766,22 @@ index 9874bb19..ab9d9022 100644 {{{ complete_ocil_entry_sysctl_option_value(sysctl="fs.protected_hardlinks", value="1") }}} diff --git a/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/kubernetes/shared.yml b/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/kubernetes/shared.yml -index 202dcf4e..ce228ef2 100644 +index 5ce0decb..b7a4243e 100644 --- a/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/rule.yml b/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/rule.yml -index 65528399..f6ae398b 100644 +index b283776e..72e7595c 100644 --- a/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/rule.yml +++ b/linux_os/guide/system/permissions/files/sysctl_fs_protected_symlinks/rule.yml -@@ -24,7 +24,7 @@ references: - cis: 1.6.1 +@@ -26,7 +26,7 @@ references: + nerc-cip: CIP-003-3 R5.1.1,CIP-003-3 R5.3,CIP-004-3 R2.3,CIP-007-3 R2.1,CIP-007-3 R2.2,CIP-007-3 R2.3,CIP-007-3 R5.1,CIP-007-3 R5.1.1,CIP-007-3 R5.1.2 nist: CM-6(a),AC-6(1) srg: SRG-OS-000324-GPOS-00125 - stigid@rhel8: RHEL-08-010373 @@ -20246,7 +15802,7 @@ index 184a746f..0807776c 100644 title: 'Assign Password to Prevent Changes to Boot Firmware Configuration' diff --git a/linux_os/guide/system/permissions/mounting/bios_disable_usb_boot/rule.yml b/linux_os/guide/system/permissions/mounting/bios_disable_usb_boot/rule.yml -index ce7279a4..df47f202 100644 +index 311ae83b..a11f1d66 100644 --- a/linux_os/guide/system/permissions/mounting/bios_disable_usb_boot/rule.yml +++ b/linux_os/guide/system/permissions/mounting/bios_disable_usb_boot/rule.yml @@ -1,6 +1,6 @@ @@ -20258,7 +15814,7 @@ index ce7279a4..df47f202 100644 title: 'Disable Booting from USB Devices in Boot Firmware' diff --git a/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml b/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml -index de30837a..e8711900 100644 +index 848e7338..8f7db86a 100644 --- a/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml +++ b/linux_os/guide/system/permissions/mounting/grub2_nousb_argument/rule.yml @@ -1,6 +1,6 @@ @@ -20270,30 +15826,31 @@ index de30837a..e8711900 100644 title: 'Disable Kernel Support for USB via Bootloader Configuration' diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/kubernetes/shared.yml -index a69f66e9..33e8700b 100644 +index 44c5bffe..2eb544c7 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/rule.yml -index 302154b6..507c217b 100644 +index a21b044b..543160de 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_cramfs_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,ubuntu1804 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu1804 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 title: 'Disable Mounting of cramfs' -@@ -39,7 +39,7 @@ references: - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4,A.9.1.2 - cis-csc: 11,14,3,9 +@@ -43,7 +43,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a) + nist-csf: PR.IP-1,PR.PT-3 srg: SRG-OS-000095-GPOS-00049 - stigid@rhel8: RHEL-08-040025 + stigid@almalinux8: RHEL-08-040025 @@ -20301,513 +15858,531 @@ index 302154b6..507c217b 100644 {{{ complete_ocil_entry_module_disable(module="cramfs") }}} diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/kubernetes/shared.yml -index 9d6e828c..72b9d2f7 100644 +index f53ca7e3..7decd700 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/rule.yml -index 4da8a206..76777e82 100644 +index cf38af75..b27990b7 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_freevxfs_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,rhv4,sle15,ubuntu1804 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu1804 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 title: 'Disable Mounting of freevxfs' diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/kubernetes/shared.yml -index 3baf256a..2a689ef3 100644 +index ef0e24a3..829121c2 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/rule.yml -index bca3d89c..dec05325 100644 +index fd08e9fa..68318195 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_hfs_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,rhv4,sle15,ubuntu1804 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu1804 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 title: 'Disable Mounting of hfs' diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/kubernetes/shared.yml -index 03138071..5034b75b 100644 +index a20bc997..8106f54c 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/rule.yml -index b6d92359..89fe32ef 100644 +index 74f69a23..ef0bdbc4 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_hfsplus_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,rhv4,sle15,ubuntu1804 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu1804 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 title: 'Disable Mounting of hfsplus' diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/kubernetes/shared.yml -index b0ecca7b..1fece6ff 100644 +index 77723846..fd3ece4c 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/rule.yml -index 6397b9cc..6c04a159 100644 +index b2203d3f..2c0bc01e 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_jffs2_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,rhv4,sle15,ubuntu1804 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle15,ubuntu1804 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu1804,ubuntu2004 title: 'Disable Mounting of jffs2' diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/kubernetes/shared.yml -index be99e6bb..f1a61993 100644 +index be4526c5..febc07d2 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/rule.yml -index 90b041a9..ad74e1bb 100644 +index f78dbb60..a29fa86f 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_squashfs_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,sle15 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Disable Mounting of squashfs' diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/kubernetes/shared.yml -index 83486ee2..3ffb3c0e 100644 +index ba69e9bf..615e5db4 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/rule.yml -index 4686c41c..3059f89c 100644 +index 7cdf27b4..b6c8f181 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_udf_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,sle15,ubuntu1804 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,sle15,ubuntu1804 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804,ubuntu2004 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804,ubuntu2004 title: 'Disable Mounting of udf' diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/kubernetes/shared.yml -index 8c8c5b09..92c1ed81 100644 +index 32e39f20..a00da355 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml -index d1d2bf97..c5f4aabc 100644 +index c8366334..737e8cf5 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_usb-storage_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Disable Modprobe Loading of USB Storage Driver' -@@ -41,7 +41,7 @@ references: - cis@rhel8: 1.1.23 - cis@sle15: 1.1.3 - stigid@sle12: SLES-12-010580 +@@ -44,7 +44,7 @@ references: + srg: SRG-OS-000114-GPOS-00059,SRG-OS-000378-GPOS-00163,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020100 + stigid@rhel7: RHEL-07-020100 - stigid@rhel8: RHEL-08-040080 + stigid@almalinux8: RHEL-08-040080 - - {{{ complete_ocil_entry_module_disable(module="usb-storage") }}} + stigid@sle12: SLES-12-010580 + stigid@sle15: SLES-15-010480 diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/kubernetes/shared.yml -index 2df05ff8..bea47357 100644 +index 2be4cc35..a50aa726 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/rule.yml -index 7383973c..f3c5e50c 100644 +index 5af0cf51..34618357 100644 --- a/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/kernel_module_vfat_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Disable Mounting of vFAT filesystems' diff --git a/linux_os/guide/system/permissions/mounting/service_autofs_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/mounting/service_autofs_disabled/kubernetes/shared.yml -index 00f06ba3..c81ad1b1 100644 +index 41352695..8b69802a 100644 --- a/linux_os/guide/system/permissions/mounting/service_autofs_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/mounting/service_autofs_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhv,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhv,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/mounting/service_autofs_disabled/rule.yml b/linux_os/guide/system/permissions/mounting/service_autofs_disabled/rule.yml -index 00d1282a..16700b80 100644 +index 2214eb95..d38bc2ee 100644 --- a/linux_os/guide/system/permissions/mounting/service_autofs_disabled/rule.yml +++ b/linux_os/guide/system/permissions/mounting/service_autofs_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019,ubuntu1804 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019,ubuntu1804 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu1804,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu1804,ubuntu2004,wrlinux1019 title: 'Disable the Automounter' -@@ -46,7 +46,7 @@ references: - iso27001-2013: A.11.2.6,A.13.1.1,A.13.2.1,A.18.1.4,A.6.2.1,A.6.2.2,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 - cis@sle15: 1.1.23 +@@ -51,7 +51,7 @@ references: + srg: SRG-OS-000114-GPOS-00059,SRG-OS-000378-GPOS-00163,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020110 + stigid@rhel7: RHEL-07-020110 - stigid@rhel8: RHEL-08-040070 + stigid@almalinux8: RHEL-08-040070 - - ocil: '{{{ ocil_service_disabled(service="autofs") }}}' + stigid@sle12: SLES-12-010590 + stigid@sle15: SLES-15-010240 diff --git a/linux_os/guide/system/permissions/partitions/mount_option_boot_noauto/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_boot_noauto/rule.yml -index 5c65ac7e..6af7c3bc 100644 +index da7833ee..47c3af4c 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_boot_noauto/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_boot_noauto/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Add noauto Option to /boot' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_boot_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_boot_nodev/rule.yml -index 52561195..85de1224 100644 +index f9eebd38..767fe30a 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_boot_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_boot_nodev/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nodev Option to /boot' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_boot_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_boot_noexec/rule.yml -index b5925dd1..6eded472 100644 +index e6f8d284..d35ad835 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_boot_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_boot_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Add noexec Option to /boot' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_boot_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_boot_nosuid/rule.yml -index a4da22f6..43a73812 100644 +index cfb5a158..5dcf3a0d 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_boot_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_boot_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nosuid Option to /boot' -@@ -27,7 +27,7 @@ references: +@@ -30,7 +30,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 - srg: SRG-OS-000368-GPOS-00154 - anssi: BP28(R12) + srg: SRG-OS-000368-GPOS-00154,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010571 + stigid@almalinux8: RHEL-08-010571 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml -index 318117fc..4b932d75 100644 +index 77699486..d09652d4 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml -@@ -36,7 +36,7 @@ references: - cis-csc: 11,13,14,3,8,9 +@@ -40,7 +40,7 @@ references: srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.16 + stigid@ol7: OL07-00-021022 + stigid@rhel7: RHEL-07-021022 - stigid@rhel8: RHEL-08-040120 + stigid@almalinux8: RHEL-08-040120 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_noexec/rule.yml -index f41387ab..babbeff1 100644 +index 0405c4a2..e30bb475 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4,sle15,ubuntu1804 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4,sle15,ubuntu1804 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804,ubuntu2004 title: 'Add noexec Option to /dev/shm' -@@ -39,7 +39,7 @@ references: - cis-csc: 11,13,14,3,8,9 +@@ -43,7 +43,7 @@ references: srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.17 + stigid@ol7: OL07-00-021024 + stigid@rhel7: RHEL-07-021024 - stigid@rhel8: RHEL-08-040122 + stigid@almalinux8: RHEL-08-040122 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml -index d844c9c3..9440c15d 100644 +index 54c05d6f..202fb4a1 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml -@@ -36,7 +36,7 @@ references: - cis-csc: 11,13,14,3,8,9 +@@ -40,7 +40,7 @@ references: srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.18 + stigid@ol7: OL07-00-021023 + stigid@rhel7: RHEL-07-021023 - stigid@rhel8: RHEL-08-040121 + stigid@almalinux8: RHEL-08-040121 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_nodev/rule.yml -index dd944b4e..6c314a80 100644 +index 07013b2e..b5fa4bfc 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_home_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_home_nodev/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhcos4,sle15,ubuntu1804 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhcos4,sle15,ubuntu1804 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804 title: 'Add nodev Option to /home' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_noexec/rule.yml -index 4e60c7a5..225563c0 100644 +index e2372df0..611b66ab 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_home_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_home_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Add noexec Option to /home' +@@ -28,7 +28,7 @@ references: + disa: CCI-000366 + nist: CM-6(b) + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-010590 ++ stigid@almalinux8: RHEL-08-010590 + + platform: machine + diff --git a/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml -index 37e8f7fb..34a0c882 100644 +index 7809a961..40fc536b 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_home_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,rhcos4,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,rhcos4,sle12 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'Add nosuid Option to /home' -@@ -38,7 +38,7 @@ references: - anssi: BP28(R12) +@@ -39,7 +39,7 @@ references: srg: SRG-OS-000368-GPOS-00154,SRG-OS-000480-GPOS-00227 - stigid@sle12: SLES-12-010790 + stigid@ol7: OL07-00-021000 + stigid@rhel7: RHEL-07-021000 - stigid@rhel8: RHEL-08-010570 + stigid@almalinux8: RHEL-08-010570 - - platform: machine + stigid@sle12: SLES-12-010790 + stigid@sle15: SLES-15-040140 diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/rule.yml -index f7c3502b..689c31b5 100644 +index c79dcb7d..e747cc4f 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_nonroot_local_partitions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nodev Option to Non-Root Local Partitions' -@@ -42,6 +42,6 @@ references: - cis-csc: 11,14,3,9 - srg: SRG-OS-000368-GPOS-00154 - anssi: BP28(R12) +@@ -44,6 +44,6 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 + nist-csf: PR.IP-1,PR.PT-3 + srg: SRG-OS-000368-GPOS-00154,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010580 + stigid@almalinux8: RHEL-08-010580 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nodev_removable_partitions/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_nodev_removable_partitions/rule.yml -index 5912fb9d..1ba87cbf 100644 +index 49ad5091..b5ba8048 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_nodev_removable_partitions/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_nodev_removable_partitions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,rhcos4,sle15,ubuntu1804 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,rhcos4,sle15,ubuntu1804 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu1804 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu1804 title: 'Add nodev Option to Removable Media Partitions' -@@ -36,7 +36,7 @@ references: - iso27001-2013: A.11.2.6,A.11.2.9,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.2.2,A.14.2.3,A.14.2.4,A.6.2.1,A.6.2.2,A.7.1.1,A.8.2.1,A.8.2.2,A.8.2.3,A.8.3.1,A.8.3.3,A.9.1.2,A.9.2.1 - cis-csc: 11,12,13,14,16,3,8,9 - cis@sle15: 1.1.19 +@@ -41,7 +41,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 + nist-csf: PR.AC-3,PR.AC-6,PR.IP-1,PR.PT-2,PR.PT-3 + srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010600 + stigid@almalinux8: RHEL-08-010600 - srg: SRG-OS-000480-GPOS-00227 platform: machine + diff --git a/linux_os/guide/system/permissions/partitions/mount_option_noexec_removable_partitions/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_noexec_removable_partitions/rule.yml -index d329ad29..abe7974f 100644 +index f92f32e8..8b1dc171 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_noexec_removable_partitions/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_noexec_removable_partitions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,rhcos4,sle15,ubuntu1804 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,rhcos4,sle15,ubuntu1804 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu1804 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu1804 title: 'Add noexec Option to Removable Media Partitions' -@@ -34,7 +34,7 @@ references: - iso27001-2013: A.11.2.6,A.11.2.9,A.12.1.2,A.12.5.1,A.12.6.2,A.13.1.1,A.13.2.1,A.14.2.2,A.14.2.3,A.14.2.4,A.6.2.1,A.6.2.2,A.7.1.1,A.8.2.1,A.8.2.2,A.8.2.3,A.8.3.1,A.8.3.3,A.9.1.2,A.9.2.1 - cis-csc: 11,12,13,14,16,3,8,9 - cis@sle15: 1.1.20 +@@ -38,7 +38,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 + nist-csf: PR.AC-3,PR.AC-6,PR.IP-1,PR.PT-2,PR.PT-3 + srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010610 + stigid@almalinux8: RHEL-08-010610 - srg: SRG-OS-000480-GPOS-00227 ocil_clause: 'removable media partitions are present' + diff --git a/linux_os/guide/system/permissions/partitions/mount_option_nosuid_removable_partitions/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_nosuid_removable_partitions/rule.yml -index 9ed257aa..d999c672 100644 +index 4efb84dc..98bf2aaa 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_nosuid_removable_partitions/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_nosuid_removable_partitions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019,rhcos4,ubuntu1804 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019,rhcos4,ubuntu1804 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu1804,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu1804,wrlinux1019 title: 'Add nosuid Option to Removable Media Partitions' -@@ -41,7 +41,7 @@ references: - cis-csc: 11,12,13,14,15,16,18,3,5,8,9 - cis@sle15: 1.1.21 - stigid@sle12: SLES-12-010800 +@@ -44,7 +44,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021010 + stigid@rhel7: RHEL-07-021010 - stigid@rhel8: RHEL-08-010620 + stigid@almalinux8: RHEL-08-010620 - - platform: machine + stigid@sle12: SLES-12-010800 + stigid@sle15: SLES-15-040150 diff --git a/linux_os/guide/system/permissions/partitions/mount_option_opt_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_opt_nosuid/rule.yml -index 949ccbd8..722a242c 100644 +index b67d96ba..c97be491 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_opt_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_opt_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Add nosuid Option to /opt' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_srv_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_srv_nosuid/rule.yml -index 9e905454..0d695f8d 100644 +index 022dee6d..50d8fc14 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_srv_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_srv_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Add nosuid Option to /srv' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml -index 35173f9e..b8259ada 100644 +index e50df715..99b0c132 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nodev/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15,ubuntu1804,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15,ubuntu1804,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804 title: 'Add nodev Option to /tmp' -@@ -35,7 +35,7 @@ references: - anssi: BP28(R12) +@@ -39,7 +39,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 + nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.4 - stigid@rhel8: RHEL-08-040123 + stigid@almalinux8: RHEL-08-040123 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml -index 4f831bda..95c46960 100644 +index 7585cc6e..6f9aa511 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_tmp_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Add noexec Option to /tmp' -@@ -34,7 +34,7 @@ references: - cis-csc: 11,13,14,3,8,9 - anssi: BP28(R12) +@@ -38,7 +38,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 + nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 - stigid@rhel8: RHEL-08-040125 + stigid@almalinux8: RHEL-08-040125 @@ -20815,39 +16390,39 @@ index 4f831bda..95c46960 100644 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml -index 5bcbebdf..9f6855a9 100644 +index b8c3b7d7..3ec7f8d5 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_tmp_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15,ubuntu1804,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15,ubuntu1804,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804 title: 'Add nosuid Option to /tmp' -@@ -35,7 +35,7 @@ references: - anssi: BP28(R12) +@@ -39,7 +39,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 + nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.5 - stigid@rhel8: RHEL-08-040124 + stigid@almalinux8: RHEL-08-040124 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nodev/rule.yml -index 404386d7..623c89e0 100644 +index 983b0734..a8694cce 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nodev/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nodev Option to /var/log/audit' -@@ -28,7 +28,7 @@ references: +@@ -31,7 +31,7 @@ references: nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 @@ -20857,18 +16432,18 @@ index 404386d7..623c89e0 100644 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_noexec/rule.yml -index 93c63a75..67ee373f 100644 +index e63c8a89..78d1fec7 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add noexec Option to /var/log/audit' -@@ -26,7 +26,7 @@ references: +@@ -29,7 +29,7 @@ references: nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 @@ -20878,18 +16453,18 @@ index 93c63a75..67ee373f 100644 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nosuid/rule.yml -index 7ee72139..834f117e 100644 +index 5de65902..fb6512c5 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_log_audit_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nosuid Option to /var/log/audit' -@@ -27,7 +27,7 @@ references: +@@ -30,7 +30,7 @@ references: nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 @@ -20899,18 +16474,18 @@ index 7ee72139..834f117e 100644 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_nodev/rule.yml -index 8959bd0b..26ab0da0 100644 +index c0a186c7..9b9847eb 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_log_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_log_nodev/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nodev Option to /var/log' -@@ -28,7 +28,7 @@ references: +@@ -31,7 +31,7 @@ references: nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 @@ -20920,80 +16495,80 @@ index 8959bd0b..26ab0da0 100644 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_noexec/rule.yml -index baf1eea4..8d3a73bd 100644 +index 53f51f64..d356c2e5 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_log_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_log_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add noexec Option to /var/log' -@@ -27,7 +27,7 @@ references: +@@ -30,7 +30,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 - anssi: BP28(R12) - stigid@rhel8: RHEL-08-040128 + stigid@almalinux8: RHEL-08-040128 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_log_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_log_nosuid/rule.yml -index beee543c..2df4d9ce 100644 +index a78026c9..2ad8ea6f 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_log_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_log_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nosuid Option to /var/log' -@@ -28,7 +28,7 @@ references: +@@ -31,7 +31,7 @@ references: + nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 nist-csf: PR.IP-1,PR.PT-2,PR.PT-3 srg: SRG-OS-000368-GPOS-00154 - anssi: BP28(R12) - stigid@rhel8: RHEL-08-040127 + stigid@almalinux8: RHEL-08-040127 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_nodev/rule.yml -index fe4aaae5..5237bbc2 100644 +index ced6ad1d..fd4c21f5 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_nodev/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhcos4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nodev Option to /var' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_noexec/rule.yml -index ef2dc47d..1495ae59 100644 +index 7119419e..eb43ae82 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Add noexec Option to /var' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_nosuid/rule.yml -index 9aa1cd25..2d4b99e0 100644 +index ca3e15f3..a16ad330 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,rhcos4 -+prodtype: fedora,rhel7,rhel8,almalinux8,rhcos4 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Add nosuid Option to /var' @@ -21008,121 +16583,123 @@ index 1466eff5..b49afe45 100644 . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml -index 394a3a74..448aebe0 100644 +index 133e7727..0ec19fa7 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_bind/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Bind Mount /var/tmp To /tmp' diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml -index 136ba137..df98873f 100644 +index bb044207..722d7a53 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nodev/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhcos4,sle15,ubuntu1804 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhcos4,sle15,ubuntu1804 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804 title: 'Add nodev Option to /var/tmp' -@@ -29,7 +29,7 @@ references: - anssi: BP28(R12) +@@ -32,7 +32,7 @@ references: + cis@ubuntu1804: 1.1.7 + disa: CCI-001764 srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.9 - stigid@rhel8: RHEL-08-040132 + stigid@almalinux8: RHEL-08-040132 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml -index 8eb0eafc..b02730f7 100644 +index 657ccaa5..c604f7ec 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_noexec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhcos4,sle15,ubuntu1804 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhcos4,sle15,ubuntu1804 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804 title: 'Add noexec Option to /var/tmp' -@@ -29,7 +29,7 @@ references: - anssi: BP28(R12) +@@ -32,7 +32,7 @@ references: + cis@ubuntu1804: 1.1.9 + disa: CCI-001764 srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.11 - stigid@rhel8: RHEL-08-040134 + stigid@almalinux8: RHEL-08-040134 platform: machine diff --git a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml -index 90c57879..6217a0dd 100644 +index d5686e4d..54531e18 100644 --- a/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml +++ b/linux_os/guide/system/permissions/partitions/mount_option_var_tmp_nosuid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhcos4,sle15,ubuntu1804 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhcos4,sle15,ubuntu1804 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804 title: 'Add nosuid Option to /var/tmp' -@@ -29,7 +29,7 @@ references: - anssi: BP28(R12) +@@ -32,7 +32,7 @@ references: + cis@ubuntu1804: 1.1.8 + disa: CCI-001764 srg: SRG-OS-000368-GPOS-00154 - cis@sle15: 1.1.10 - stigid@rhel8: RHEL-08-040133 + stigid@almalinux8: RHEL-08-040133 platform: machine diff --git a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/kubernetes/shared.yml -index 23647c69..49034b0d 100644 +index d9480227..554e34e0 100644 --- a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/rule.yml b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/rule.yml -index 79af2052..74adb940 100644 +index 29bd63b8..b61ada5d 100644 --- a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_backtraces/rule.yml -@@ -30,7 +30,7 @@ references: +@@ -34,7 +34,7 @@ references: + disa: CCI-000366 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000480-GPOS-00227 - cis@rhel8: 1.6.1 - stigid@rhel8: RHEL-08-010675 + stigid@almalinux8: RHEL-08-010675 ocil_clause: ProcessSizeMax is not set to zero diff --git a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/kubernetes/shared.yml -index 23647c69..49034b0d 100644 +index d9480227..554e34e0 100644 --- a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/rule.yml b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/rule.yml -index 9fdb4d8f..bf2925f4 100644 +index fc23ce0a..538f7f37 100644 --- a/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/coredumps/coredump_disable_storage/rule.yml -@@ -26,7 +26,7 @@ references: +@@ -30,7 +30,7 @@ references: + disa: CCI-000366 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000480-GPOS-00227 - cis@rhel8: 1.6.1 - stigid@rhel8: RHEL-08-010674 + stigid@almalinux8: RHEL-08-010674 @@ -21139,30 +16716,31 @@ index 5d6b55f0..97f8f558 100644 if grep -qE '\*\s+hard\s+core' $SECURITY_LIMITS_FILE; then diff --git a/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/kubernetes/shared.yml -index 6f9455b9..62d07a86 100644 +index 41cbd119..481afa58 100644 --- a/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/rule.yml b/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/rule.yml -index 991c92dd..a325550b 100644 +index 09ad7d43..b5418dc6 100644 --- a/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/coredumps/disable_users_coredumps/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu2004 title: 'Disable Core Dumps for All Users' -@@ -30,7 +30,7 @@ references: +@@ -34,7 +34,7 @@ references: iso27001-2013: A.12.1.3,A.17.2.1 - cis-csc: 1,12,13,15,16,2,7,8 + nist-csf: DE.CM-1,PR.DS-4 srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010673 + stigid@almalinux8: RHEL-08-010673 @@ -21170,19 +16748,19 @@ index 991c92dd..a325550b 100644 ocil_clause: 'it is not' diff --git a/linux_os/guide/system/permissions/restrictions/coredumps/service_systemd-coredump_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/coredumps/service_systemd-coredump_disabled/rule.yml -index 125e764b..9d1c6765 100644 +index 9524302e..c384e918 100644 --- a/linux_os/guide/system/permissions/restrictions/coredumps/service_systemd-coredump_disabled/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/coredumps/service_systemd-coredump_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Disable acquiring, saving, and processing core dumps' -@@ -25,7 +25,7 @@ identifiers: - references: +@@ -27,7 +27,7 @@ references: + disa: CCI-000366 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010672 @@ -21201,7 +16779,7 @@ index f689f4b2..34430b60 100644 {{{ bash_instantiate_variables("var_umask_for_daemons") }}} diff --git a/linux_os/guide/system/permissions/restrictions/daemon_umask/umask_for_daemons/rule.yml b/linux_os/guide/system/permissions/restrictions/daemon_umask/umask_for_daemons/rule.yml -index 9039909d..5159b7aa 100644 +index 6b2922e1..6cccb08a 100644 --- a/linux_os/guide/system/permissions/restrictions/daemon_umask/umask_for_daemons/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/daemon_umask/umask_for_daemons/rule.yml @@ -1,6 +1,6 @@ @@ -21212,124 +16790,121 @@ index 9039909d..5159b7aa 100644 title: 'Set Daemon Umask' -diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/bash/shared.sh b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/bash/shared.sh -index cf0da83d..cf230476 100644 ---- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/bash/shared.sh -+++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/bash/shared.sh -@@ -1,7 +1,7 @@ - # Include source function library. - . /usr/share/scap-security-guide/remediation_functions - --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_rhv - if [ "$(getconf LONG_BIT)" = "32" ] ; then - # - # Set runtime for kernel.exec-shield diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/rule.yml -index c584d7ff..1278522b 100644 +index 579b8641..4dc86daf 100644 --- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_exec_shield/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,rhv4 -+prodtype: fedora,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable ExecShield via sysctl' diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/kubernetes/shared.yml -index b2136788..76db834f 100644 +index 415b0486..02b1e991 100644 --- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml -index c9794729..6eae8d6e 100644 +index bb3cf0ba..53b0c98a 100644 --- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_kptr_restrict/rule.yml -@@ -22,7 +22,7 @@ references: - anssi: BP28(R23) +@@ -27,7 +27,7 @@ references: + nerc-cip: CIP-002-3 R1.1,CIP-002-3 R1.2,CIP-003-3 R5.1.1,CIP-003-3 R5.3,CIP-004-3 4.1,CIP-004-3 4.2,CIP-004-3 R2.2.3,CIP-004-3 R2.2.4,CIP-004-3 R2.3,CIP-004-3 R4,CIP-005-3a R1,CIP-005-3a R1.1,CIP-005-3a R1.2,CIP-007-3 R3,CIP-007-3 R3.1,CIP-007-3 R5.1,CIP-007-3 R5.1.2,CIP-007-3 R5.1.3,CIP-007-3 R5.2.1,CIP-007-3 R5.2.3,CIP-007-3 R8.4,CIP-009-3 R.1.1,CIP-009-3 R4 nist: SC-30,SC-30(2),SC-30(5),CM-6(a) - srg: SRG-OS-000132-GPOS-00067 + srg: SRG-OS-000132-GPOS-00067,SRG-OS-000433-GPOS-00192,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040283 + stigid@almalinux8: RHEL-08-040283 - - {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.kptr_restrict", value="1") }}} + stigid@sle12: SLES-12-030320 + stigid@sle15: SLES-15-010540 diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/kubernetes/shared.yml -index 1284acb3..5fb5baa6 100644 +index 7a4c107b..22e20912 100644 --- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/rule.yml -index 950ae6b0..a7c9665d 100644 +index 852c9023..11e13949 100644 --- a/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/enable_execshield_settings/sysctl_kernel_randomize_va_space/rule.yml -@@ -29,7 +29,7 @@ references: - nist: SC-30,SC-30(2),CM-6(a) +@@ -34,7 +34,7 @@ references: srg: SRG-OS-000433-GPOS-00193,SRG-OS-000480-GPOS-00227 - anssi: BP28(R23) + stigid@ol7: OL07-00-040201 + stigid@rhel7: RHEL-07-040201 - stigid@rhel8: RHEL-08-010430 + stigid@almalinux8: RHEL-08-010430 - - {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.randomize_va_space", value="2") }}} - + stigid@sle12: SLES-12-030330 + stigid@sle15: SLES-15-010550 + stigid@ubuntu2004: UBTU-20-010448 diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml -index e3a6c5a6..14c6fd7b 100644 +index 2176a0bb..12fde141 100644 --- a/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/enable_nx/bios_enable_execution_restrictions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 - - title: 'Enable NX or XD Support in the BIOS' - -diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml -index ff60829e..8a7e31ae 100644 ---- a/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml -+++ b/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: fedora,rhel7,rhel8,rhv4 -+prodtype: fedora,rhel7,rhel8,almalinux8,rhv4 - - title: 'Install PAE Kernel on Supported 32-bit x86 Systems' - -diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml -index 48acc4d2..48379fb0 100644 ---- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml -+++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - -prodtype: fedora,ol7,ol8,rhel7,rhel8 +prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 + title: 'Enable NX or XD Support in the BIOS' + +@@ -32,6 +32,6 @@ references: + nist: SC-39,CM-6(a) + nist-csf: PR.IP-1 + srg: SRG-OS-000433-GPOS-00192 +- stigid@rhel8: RHEL-08-010420 ++ stigid@almalinux8: RHEL-08-010420 + + platform: machine +diff --git a/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml b/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml +index 48e4b420..2c608f53 100644 +--- a/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml ++++ b/linux_os/guide/system/permissions/restrictions/enable_nx/install_PAE_kernel_on_x86-32/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 + + title: 'Install PAE Kernel on Supported 32-bit x86 Systems' + +diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml +index 66899c63..82e5f8bb 100644 +--- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml ++++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_page_poison_argument/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 + title: 'Enable page allocator poisoning' -@@ -27,7 +27,7 @@ identifiers: - references: - srg: SRG-OS-000480-GPOS-00227 +@@ -29,7 +29,7 @@ references: + disa: CCI-001084 nist: CM-6(a) + srg: SRG-OS-000480-GPOS-00227,SRG-OS-000134-GPOS-00068 - stigid@rhel8: RHEL-08-010421 + stigid@almalinux8: RHEL-08-010421 ocil_clause: 'page allocator poisoning is not enabled' -@@ -54,9 +54,9 @@ warnings: - <pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> +@@ -56,9 +56,9 @@ warnings: + <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command as <tt>root</tt>: {{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}} - <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> @@ -21341,28 +16916,28 @@ index 48acc4d2..48379fb0 100644 </ul> diff --git a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml -index 516409b6..fd21c1d3 100644 +index 9d90eaa5..61bdf449 100644 --- a/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/poisoning/grub2_slub_debug_argument/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Enable SLUB/SLAB allocator poisoning' -@@ -27,7 +27,7 @@ identifiers: - references: - srg: SRG-OS-000433-GPOS-00192 +@@ -29,7 +29,7 @@ references: + disa: CCI-001084 nist: CM-6(a) + srg: SRG-OS-000433-GPOS-00192,SRG-OS-000134-GPOS-00068 - stigid@rhel8: RHEL-08-010423 + stigid@almalinux8: RHEL-08-010423 ocil_clause: 'SLUB/SLAB poisoning is not enabled' -@@ -54,9 +54,9 @@ warnings: - <pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> +@@ -56,9 +56,9 @@ warnings: + <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command as <tt>root</tt>: {{% if product in ["rhel7", "rhel8", "ol7", "ol8"] %}} - <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> @@ -21374,29 +16949,30 @@ index 516409b6..fd21c1d3 100644 </ul> diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/kubernetes/shared.yml -index dcc07dd7..5f1756b0 100644 +index 88c68344..fa9b2020 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml -index 60e50484..8bb15695 100644 +index 4a8bf79e..ed7b7927 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_core_pattern/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Disable storing core dumps' -@@ -20,7 +20,7 @@ identifiers: - references: +@@ -22,7 +22,7 @@ references: + disa: CCI-000366 ospp: FMT_SMF_EXT.1 srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010671 @@ -21405,267 +16981,283 @@ index 60e50484..8bb15695 100644 {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.core_pattern", value="|/bin/false") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/kubernetes/shared.yml -index 2a41e267..805c8397 100644 +index 36e025cc..e97acde1 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml -index 90fcd34f..30d0db73 100644 +index 434a87a1..8b1daa2f 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_dmesg_restrict/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Restrict Access to Kernel Message Buffer' -@@ -24,7 +24,7 @@ references: +@@ -25,7 +25,7 @@ references: + hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3),164.308(a)(4),164.310(b),164.310(c),164.312(a),164.312(e) nist: SI-11(a),SI-11(b) - anssi: BP28(R23) - srg: SRG-OS-000132-GPOS-00067 + srg: SRG-OS-000132-GPOS-00067,SRG-OS-000138-GPOS-00069 - stigid@rhel8: RHEL-08-010375 + stigid@almalinux8: RHEL-08-010375 {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.dmesg_restrict", value="1") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/kubernetes/shared.yml -index 0e9d3cc9..369326c0 100644 +index 505b3c12..cdf18e6d 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/rule.yml -index 83710b7c..be500446 100644 +index d677fd62..42b854b0 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_kexec_load_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Kernel Image Loading' -@@ -19,7 +19,7 @@ identifiers: - +@@ -21,7 +21,7 @@ identifiers: references: - srg: SRG-OS-000480-GPOS-00227 + disa: CCI-001749 + srg: SRG-OS-000480-GPOS-00227,SRG-OS-000366-GPOS-00153 - stigid@rhel8: RHEL-08-010372 + stigid@almalinux8: RHEL-08-010372 {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.kexec_load_disabled", value="1") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml -index 438cd275..cb51e625 100644 +index 1722b937..03e919ac 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_modules_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel7,rhel8 -+prodtype: fedora,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable loading and unloading of kernel modules' diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_cpu_time_max_percent/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_cpu_time_max_percent/rule.yml -index eb580cf6..3a127b0c 100644 +index 52456967..c4915c47 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_cpu_time_max_percent/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_cpu_time_max_percent/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel7,rhel8 -+prodtype: fedora,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Limit CPU consumption of the Perf system' diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_max_sample_rate/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_max_sample_rate/rule.yml -index 3123fe46..eac9f645 100644 +index f78db1b0..53059efc 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_max_sample_rate/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_max_sample_rate/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel7,rhel8 -+prodtype: fedora,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Limit sampling frequency of the Perf system' diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/kubernetes/shared.yml -index 842cf6cd..2506a244 100644 +index 0541e59a..50020c28 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/rule.yml -index c9fe044a..8275d0d4 100644 +index 77eeb2e7..acfac8ca 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_perf_event_paranoid/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Disallow kernel profiling by unprivileged users' -@@ -20,7 +20,7 @@ references: - anssi: BP28(R23) +@@ -22,7 +22,7 @@ references: + disa: CCI-001090 ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000132-GPOS-00067 + srg: SRG-OS-000132-GPOS-00067,SRG-OS-000138-GPOS-00069 - stigid@rhel8: RHEL-08-010376 + stigid@almalinux8: RHEL-08-010376 {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.perf_event_paranoid", value="2") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_pid_max/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_pid_max/rule.yml -index a9f426c4..82868ae4 100644 +index 4299f35b..56bb333d 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_pid_max/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_pid_max/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel7,rhel8 -+prodtype: fedora,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Configure maximum number of process identifiers' diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_sysrq/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_sysrq/rule.yml -index ae2af137..48e8481f 100644 +index f17eeb7a..31e51854 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_sysrq/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_sysrq/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel7,rhel8 -+prodtype: fedora,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disallow magic SysRq key' diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/kubernetes/shared.yml -index 5260f3d6..471f7383 100644 +index 2e24d921..7b706bb3 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/rule.yml -index 200c2eba..2e0a273c 100644 +index 6e5576ed..8dc759a4 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_unprivileged_bpf_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Disable Access to Network bpf() Syscall From Unprivileged Processes' -@@ -20,7 +20,7 @@ identifiers: - references: +@@ -22,7 +22,7 @@ references: + disa: CCI-000366 ospp: FMT_SMF_EXT.1 - srg: SRG-OS-000132-GPOS-00067 + srg: SRG-OS-000132-GPOS-00067,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040281 + stigid@almalinux8: RHEL-08-040281 {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.unprivileged_bpf_disabled", value="1") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/kubernetes/shared.yml -index 8f8ee9e6..51b1c825 100644 +index ceafd483..7006e206 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml -index 68483432..5fde719f 100644 +index 7ef5b5ed..7e6a20b0 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_kernel_yama_ptrace_scope/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 title: 'Restrict usage of ptrace to descendant processes' -@@ -22,7 +22,7 @@ identifiers: - references: +@@ -24,7 +24,7 @@ references: anssi: BP28(R25) - srg: SRG-OS-000132-GPOS-00067 + disa: CCI-000366 + srg: SRG-OS-000132-GPOS-00067,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040282 + stigid@almalinux8: RHEL-08-040282 {{{ complete_ocil_entry_sysctl_option_value(sysctl="kernel.yama.ptrace_scope", value="1") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/kubernetes/shared.yml -index 0658d750..08b4033b 100644 +index 7519b774..af6c30ab 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_fedora +# platform = multi_platform_rhcos,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml -index 9094985e..60134a02 100644 +index 31b7183b..755c1b4d 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_net_core_bpf_jit_harden/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Harden the operation of the BPF just-in-time compiler' +@@ -23,7 +23,7 @@ references: + nist: CM-6b + ospp: FMT_SMF_EXT.1 + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-040286 ++ stigid@almalinux8: RHEL-08-040286 + + {{{ complete_ocil_entry_sysctl_option_value(sysctl="net.core.bpf_jit_harden", value="2") }}} + diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/kubernetes/shared.yml b/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/kubernetes/shared.yml -index 66aae71b..d39a07b9 100644 +index fdd4fb83..3274d5b3 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/kubernetes/shared.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/kubernetes/shared.yml -@@ -1,4 +1,4 @@ +@@ -1,5 +1,5 @@ + --- -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_rhcos +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_rhcos apiVersion: machineconfiguration.openshift.io/v1 kind: MachineConfig spec: diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/rule.yml -index 5e3929ec..fa72fb18 100644 +index 2e11533e..856045df 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_user_max_user_namespaces/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9 title: 'Disable the use of user namespaces' -@@ -29,7 +29,7 @@ references: - ospp: FMT_SMF_EXT.1 +@@ -31,7 +31,7 @@ references: nist: SC-39,CM-6(a) + ospp: FMT_SMF_EXT.1 srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040284 + stigid@almalinux8: RHEL-08-040284 @@ -21673,33 +17265,29 @@ index 5e3929ec..fa72fb18 100644 {{{ complete_ocil_entry_sysctl_option_value(sysctl="user.max_user_namespaces", value="0") }}} diff --git a/linux_os/guide/system/permissions/restrictions/sysctl_vm_mmap_min_addr/rule.yml b/linux_os/guide/system/permissions/restrictions/sysctl_vm_mmap_min_addr/rule.yml -index 026c651b..0fadfb8c 100644 +index 93a11ee5..61e87801 100644 --- a/linux_os/guide/system/permissions/restrictions/sysctl_vm_mmap_min_addr/rule.yml +++ b/linux_os/guide/system/permissions/restrictions/sysctl_vm_mmap_min_addr/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel7,rhel8 -+prodtype: fedora,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Prevent applications from mapping low portion of virtual memory' -diff --git a/linux_os/guide/system/selinux/group.yml b/linux_os/guide/system/selinux/group.yml -index 6525cb49..9aa698fa 100644 ---- a/linux_os/guide/system/selinux/group.yml -+++ b/linux_os/guide/system/selinux/group.yml -@@ -23,11 +23,5 @@ description: |- - default (targeted) policy on every {{{ full_name }}} system, unless that - system has unusual requirements which make a stronger policy - appropriate. -- {{% if product == "rhel7" %}} -- <br /><br /> -- For more information on SELinux, see <b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide") }}}</b>. -- {{% elif product == "ol7" %}} -- For more information on SELinux, see <b>{{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54669/html/ol7-s1-syssec.html") }}}</b>. -- {{% endif %}} +diff --git a/linux_os/guide/system/selinux/coreos_enable_selinux_kernel_argument/rule.yml b/linux_os/guide/system/selinux/coreos_enable_selinux_kernel_argument/rule.yml +index 297512e4..32f67ae3 100644 +--- a/linux_os/guide/system/selinux/coreos_enable_selinux_kernel_argument/rule.yml ++++ b/linux_os/guide/system/selinux/coreos_enable_selinux_kernel_argument/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 + + title: 'Ensure SELinux Not Disabled in the kernel arguments' - platform: machine diff --git a/linux_os/guide/system/selinux/grub2_enable_selinux/ansible/shared.yml b/linux_os/guide/system/selinux/grub2_enable_selinux/ansible/shared.yml index e9ff094d..f0a8bcdb 100644 --- a/linux_os/guide/system/selinux/grub2_enable_selinux/ansible/shared.yml @@ -21721,3659 +17309,3683 @@ index 735354a2..0c13b196 100644 sed -i --follow-symlinks "s/selinux=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/* sed -i --follow-symlinks "s/enforcing=0//gI" /etc/default/grub /etc/grub2.cfg /etc/grub.d/* diff --git a/linux_os/guide/system/selinux/grub2_enable_selinux/rule.yml b/linux_os/guide/system/selinux/grub2_enable_selinux/rule.yml -index a5bab5f5..3dc0043d 100644 +index a313831b..e1532946 100644 --- a/linux_os/guide/system/selinux/grub2_enable_selinux/rule.yml +++ b/linux_os/guide/system/selinux/grub2_enable_selinux/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Ensure SELinux Not Disabled in /etc/default/grub' diff --git a/linux_os/guide/system/selinux/package_libselinux_installed/rule.yml b/linux_os/guide/system/selinux/package_libselinux_installed/rule.yml -index 1785951f..82bc4bd5 100644 +index d38f1829..c6e06cb7 100644 --- a/linux_os/guide/system/selinux/package_libselinux_installed/rule.yml +++ b/linux_os/guide/system/selinux/package_libselinux_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,rhcos4,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,rhcos4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Install libselinux Package' diff --git a/linux_os/guide/system/selinux/package_mcstrans_removed/rule.yml b/linux_os/guide/system/selinux/package_mcstrans_removed/rule.yml -index 6cbcc4f5..8b9142a9 100644 +index 81f72105..f5fa640c 100644 --- a/linux_os/guide/system/selinux/package_mcstrans_removed/rule.yml +++ b/linux_os/guide/system/selinux/package_mcstrans_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,sle15 -+prodtype: fedora,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Uninstall mcstrans Package' diff --git a/linux_os/guide/system/selinux/package_policycoreutils-python-utils_installed/rule.yml b/linux_os/guide/system/selinux/package_policycoreutils-python-utils_installed/rule.yml -index 6c23fae1..4f9d6675 100644 +index 74c92194..4bf954c8 100644 --- a/linux_os/guide/system/selinux/package_policycoreutils-python-utils_installed/rule.yml +++ b/linux_os/guide/system/selinux/package_policycoreutils-python-utils_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8 -+prodtype: ol8,rhel8,almalinux8 +-prodtype: ol8,rhel8,rhel9 ++prodtype: ol8,rhel8,almalinux8,rhel9 title: 'Install policycoreutils-python-utils package' diff --git a/linux_os/guide/system/selinux/package_policycoreutils_installed/rule.yml b/linux_os/guide/system/selinux/package_policycoreutils_installed/rule.yml -index a107af62..2c954abb 100644 +index 759f453f..b73935e5 100644 --- a/linux_os/guide/system/selinux/package_policycoreutils_installed/rule.yml +++ b/linux_os/guide/system/selinux/package_policycoreutils_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install policycoreutils Package' -@@ -30,7 +30,7 @@ identifiers: - +@@ -31,7 +31,7 @@ identifiers: references: + disa: CCI-001084 srg: SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-010171 + stigid@almalinux8: RHEL-08-010171 ocil_clause: 'the package is not installed' +diff --git a/linux_os/guide/system/selinux/package_setroubleshoot-plugins_removed/rule.yml b/linux_os/guide/system/selinux/package_setroubleshoot-plugins_removed/rule.yml +index d20c1116..78446be3 100644 +--- a/linux_os/guide/system/selinux/package_setroubleshoot-plugins_removed/rule.yml ++++ b/linux_os/guide/system/selinux/package_setroubleshoot-plugins_removed/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 + + title: 'Uninstall setroubleshoot-plugins Package' + +diff --git a/linux_os/guide/system/selinux/package_setroubleshoot-server_removed/rule.yml b/linux_os/guide/system/selinux/package_setroubleshoot-server_removed/rule.yml +index c5fec06d..ff4e6b57 100644 +--- a/linux_os/guide/system/selinux/package_setroubleshoot-server_removed/rule.yml ++++ b/linux_os/guide/system/selinux/package_setroubleshoot-server_removed/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9 + + title: 'Uninstall setroubleshoot-server Package' + diff --git a/linux_os/guide/system/selinux/package_setroubleshoot_removed/rule.yml b/linux_os/guide/system/selinux/package_setroubleshoot_removed/rule.yml -index fb25ba1b..d6603bd5 100644 +index 8992283a..f6cabc95 100644 --- a/linux_os/guide/system/selinux/package_setroubleshoot_removed/rule.yml +++ b/linux_os/guide/system/selinux/package_setroubleshoot_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,sle15 -+prodtype: fedora,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle15 title: 'Uninstall setroubleshoot Package' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_anon_write/rule.yml -index 8cf0b59e..d09e423c 100644 +index 90434f6a..83e9bad0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the abrt_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_handle_event/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_handle_event/rule.yml -index 96a33aa5..0446f71e 100644 +index 6f00cc5d..56f78524 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_handle_event/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_handle_event/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the abrt_handle_event SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_upload_watch_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_upload_watch_anon_write/rule.yml -index 8bb491c3..6bea1884 100644 +index 6aedbd4b..7fc72b46 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_upload_watch_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_abrt_upload_watch_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the abrt_upload_watch_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_can_scan_system/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_can_scan_system/rule.yml -index 121a20bc..ae1be405 100644 +index 9059fdf0..2f1dd2ed 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_can_scan_system/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_can_scan_system/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the antivirus_can_scan_system SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_use_jit/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_use_jit/rule.yml -index e6e4db3e..4f326276 100644 +index ebbce6ed..fec2f5d6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_use_jit/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_antivirus_use_jit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the antivirus_use_jit SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_auditadm_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_auditadm_exec_content/rule.yml -index 7f62cbc4..810fc617 100644 +index f3be1c78..405ac2f7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_auditadm_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_auditadm_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the auditadm_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_nsswitch_use_ldap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_nsswitch_use_ldap/rule.yml -index 94da96b5..0718ce48 100644 +index 1de5f715..c45f45d5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_nsswitch_use_ldap/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_nsswitch_use_ldap/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the authlogin_nsswitch_use_ldap SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_radius/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_radius/rule.yml -index 0c7cd89c..5850b310 100644 +index 57cb33c8..00e5d2e7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_radius/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_radius/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the authlogin_radius SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_yubikey/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_yubikey/rule.yml -index d5c3b2d2..1f598eca 100644 +index fc7a5770..b937eb9a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_yubikey/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_authlogin_yubikey/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the authlogin_yubikey SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_awstats_purge_apache_log_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_awstats_purge_apache_log_files/rule.yml -index 8d3ba46e..e7ea3afc 100644 +index e6c6bbe3..b3411ada 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_awstats_purge_apache_log_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_awstats_purge_apache_log_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the awstats_purge_apache_log_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_boinc_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_boinc_execmem/rule.yml -index ada23a12..2ba407bd 100644 +index 8cba7a6c..e6fe999d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_boinc_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_boinc_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the boinc_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cdrecord_read_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cdrecord_read_content/rule.yml -index c91ea638..f68f50eb 100644 +index 6d1ab1fb..b657ac12 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cdrecord_read_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cdrecord_read_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cdrecord_read_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_can_network_connect/rule.yml -index 379ff1f0..9e3b3280 100644 +index d38be936..09cc2e6e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cluster_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_manage_all_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_manage_all_files/rule.yml -index 59d8031e..436cf42f 100644 +index a6558b75..acb9fd61 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_manage_all_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_manage_all_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cluster_manage_all_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_use_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_use_execmem/rule.yml -index 7821e870..2bbd8939 100644 +index 4dba59fc..8d2948e6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_use_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cluster_use_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cluster_use_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_anon_write/rule.yml -index 20410a12..08f2f797 100644 +index 9c405241..11375b94 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cobbler_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_can_network_connect/rule.yml -index 51019f37..b4c27f73 100644 +index 96c0e256..08ea062a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cobbler_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_cifs/rule.yml -index b13d5ad0..8b879660 100644 +index 93bdc97c..3b2b401d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cobbler_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_nfs/rule.yml -index d966a917..650521da 100644 +index a7d6e9e7..02a7c4db 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cobbler_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cobbler_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_collectd_tcp_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_collectd_tcp_network_connect/rule.yml -index a37cdae2..b957c1c5 100644 +index d2c8b686..f9c7e326 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_collectd_tcp_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_collectd_tcp_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the collectd_tcp_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_condor_tcp_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_condor_tcp_network_connect/rule.yml -index 013787bf..274aa31e 100644 +index 1f560285..38809dd3 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_condor_tcp_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_condor_tcp_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the condor_tcp_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_conman_can_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_conman_can_network/rule.yml -index d11043ad..a239e797 100644 +index c880bf74..cc1d9b92 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_conman_can_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_conman_can_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the conman_can_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml -index 4a796474..2caf423a 100644 +index e9051bb9..e4bd1074 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_container_connect_any/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the container_connect_any SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_can_relabel/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_can_relabel/rule.yml -index df124598..0b8b71cf 100644 +index 8030890f..ebdcc1a5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_can_relabel/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_can_relabel/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the cron_can_relabel SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_system_cronjob_use_shares/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_system_cronjob_use_shares/rule.yml -index 1ad93e32..259cf39f 100644 +index 1c0270c0..d605ca51 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_system_cronjob_use_shares/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_system_cronjob_use_shares/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the cron_system_cronjob_use_shares SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_userdomain_transition/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_userdomain_transition/rule.yml -index d975541c..e67b9b41 100644 +index db921dc0..ba593d16 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_userdomain_transition/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cron_userdomain_transition/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the cron_userdomain_transition SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cups_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cups_execmem/rule.yml -index ee135d2d..a574619d 100644 +index d1d7ded6..4fb4bf2c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cups_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cups_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cups_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_cvs_read_shadow/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_cvs_read_shadow/rule.yml -index 0c30cca7..d4223dbb 100644 +index af5727d6..6cae839d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_cvs_read_shadow/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_cvs_read_shadow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the cvs_read_shadow SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_dump_core/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_dump_core/rule.yml -index dbe50667..db51bbf6 100644 +index 7ef9fda5..02fbacc4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_dump_core/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_dump_core/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the daemons_dump_core SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_enable_cluster_mode/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_enable_cluster_mode/rule.yml -index a20039aa..ef51eeda 100644 +index 07ef4320..0a1a11d7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_enable_cluster_mode/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_enable_cluster_mode/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the daemons_enable_cluster_mode SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tcp_wrapper/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tcp_wrapper/rule.yml -index 67946241..c855009a 100644 +index 64be1daf..c5e1f925 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tcp_wrapper/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tcp_wrapper/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the daemons_use_tcp_wrapper SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tty/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tty/rule.yml -index 5837c3ba..84df3409 100644 +index 9a92ccdd..dce9bc4b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tty/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_daemons_use_tty/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the daemons_use_tty SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_exec_content/rule.yml -index 858c0d10..3865daf1 100644 +index c75cce8a..cb56c79e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the dbadm_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_manage_user_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_manage_user_files/rule.yml -index 931e3049..87b694ed 100644 +index 2b9a11ba..3e1236fb 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_manage_user_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_manage_user_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the dbadm_manage_user_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_read_user_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_read_user_files/rule.yml -index d3d5a7fc..35754ddc 100644 +index 707d7113..82b8a228 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_read_user_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_dbadm_read_user_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the dbadm_read_user_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml -index ed96d01f..09d2a14d 100644 +index 2a35a2db..d9aefa8c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 - title: 'Disable the deny_execmem SELinux Boolean' + title: 'Enable the deny_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_ptrace/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_ptrace/rule.yml -index d3fa16f5..4d183301 100644 +index 1dd4eef6..1356b6fd 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_ptrace/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_deny_ptrace/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the deny_ptrace SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpc_exec_iptables/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpc_exec_iptables/rule.yml -index 8ba08904..0adfc31f 100644 +index 9b4bfe10..d648713f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpc_exec_iptables/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpc_exec_iptables/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the dhcpc_exec_iptables SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpd_use_ldap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpd_use_ldap/rule.yml -index b5d3065a..3195a273 100644 +index 75f044c4..c2cec43e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpd_use_ldap/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_dhcpd_use_ldap/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the dhcpd_use_ldap SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_fd_use/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_fd_use/rule.yml -index 274049ae..426b62f3 100644 +index a5acdd0f..b208f50b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_fd_use/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_fd_use/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the domain_fd_use SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_kernel_load_modules/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_kernel_load_modules/rule.yml -index 0ebcd138..73dc57c8 100644 +index bbc2a154..84c0a25c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_kernel_load_modules/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_domain_kernel_load_modules/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the domain_kernel_load_modules SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_entropyd_use_audio/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_entropyd_use_audio/rule.yml -index 4670b928..3d8ad66e 100644 +index 2c75b117..a87eabb4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_entropyd_use_audio/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_entropyd_use_audio/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the entropyd_use_audio SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_can_connect_db/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_can_connect_db/rule.yml -index d51de115..14f495db 100644 +index 12305e08..3d287f7c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_can_connect_db/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_can_connect_db/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the exim_can_connect_db SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_manage_user_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_manage_user_files/rule.yml -index ba27309e..d23743af 100644 +index 2d54130d..3c3d3645 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_manage_user_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_manage_user_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the exim_manage_user_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_read_user_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_read_user_files/rule.yml -index 07d19af7..401db147 100644 +index b240c116..93ecd94c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_read_user_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_exim_read_user_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the exim_read_user_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_fcron_crond/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_fcron_crond/rule.yml -index d4cd0f86..0d671ca8 100644 +index 9b3cf756..f8ea2f6c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_fcron_crond/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_fcron_crond/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the fcron_crond SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_network_connect/rule.yml -index f470600f..312fa446 100644 +index 1f71bedb..3316263f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the fenced_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_ssh/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_ssh/rule.yml -index d37d6273..3ef60e19 100644 +index cac41de7..96edf0ff 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_ssh/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_fenced_can_ssh/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the fenced_can_ssh SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_fips_mode/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_fips_mode/rule.yml -index cc3abdfb..85454074 100644 +index 5851293f..ec0a9345 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_fips_mode/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_fips_mode/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the fips_mode SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_anon_write/rule.yml -index 543d3fd6..7fdb52f8 100644 +index dbf31b53..2b2f5bc3 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_all_unreserved/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_all_unreserved/rule.yml -index ddf070c2..5cc7c69b 100644 +index 579ac3f5..7ebfb8bd 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_all_unreserved/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_all_unreserved/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_connect_all_unreserved SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_db/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_db/rule.yml -index 580302e7..82f89609 100644 +index f2d973ba..b473ef96 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_db/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_connect_db/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_connect_db SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_full_access/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_full_access/rule.yml -index e92d9e3d..25e22fb6 100644 +index cf9e7826..017cfec4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_full_access/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_full_access/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_full_access SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_cifs/rule.yml -index 57a2076a..da541b58 100644 +index 14b1f752..73153bbf 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_fusefs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_fusefs/rule.yml -index 83847018..49dd22f3 100644 +index 6cb9d9df..896fb999 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_fusefs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_fusefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_use_fusefs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_nfs/rule.yml -index 677a6c3d..ff452098 100644 +index 4035d4f8..e9e734e1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_passive_mode/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_passive_mode/rule.yml -index 2fe3581a..a8371d59 100644 +index c1236064..f2276697 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_passive_mode/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ftpd_use_passive_mode/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ftpd_use_passive_mode SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_enable_homedirs/rule.yml -index 94fc0b51..ad4ebe2d 100644 +index 47e9b420..86d7f819 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_enable_homedirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_enable_homedirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_cgi_enable_homedirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_cifs/rule.yml -index dd96e9a6..9ddd75dc 100644 +index ca5a2bcd..cc91e16f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_cgi_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_nfs/rule.yml -index 305ec104..8205c20a 100644 +index f8b5c912..cee5cb7a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_cgi_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_cgi_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_bind_all_unreserved_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_bind_all_unreserved_ports/rule.yml -index 7ac68e42..8bb0c982 100644 +index 8dffa1dd..855a231f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_bind_all_unreserved_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_bind_all_unreserved_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_session_bind_all_unreserved_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_users/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_users/rule.yml -index 4d941556..4ab54269 100644 +index f4dca61a..7c8c3dd2 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_users/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_session_users/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_session_users SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_enable_homedirs/rule.yml -index 4a576e06..44045585 100644 +index 170fcfdf..31ad34ce 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_enable_homedirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_enable_homedirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_system_enable_homedirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_cifs/rule.yml -index ea60ce0c..056e0d3c 100644 +index c46e622e..8935f832 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_system_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_nfs/rule.yml -index 7c3b62a7..fd5df642 100644 +index b149744b..4006fe66 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_git_system_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the git_system_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_gitosis_can_sendmail/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_gitosis_can_sendmail/rule.yml -index 6d187556..4aeb35f2 100644 +index 2fa3db75..dba2c36f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_gitosis_can_sendmail/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_gitosis_can_sendmail/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the gitosis_can_sendmail SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_api_can_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_api_can_network/rule.yml -index 0a6caa2f..48649e1d 100644 +index f8324918..790d5167 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_api_can_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_api_can_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the glance_api_can_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_execmem/rule.yml -index da6ee7f3..62c352e6 100644 +index ee835d3e..24ee3fae 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the glance_use_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_fusefs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_fusefs/rule.yml -index 18643fdb..51d267f5 100644 +index 70546358..3146c801 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_fusefs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_glance_use_fusefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the glance_use_fusefs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_global_ssp/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_global_ssp/rule.yml -index 6169ee96..d745d45a 100644 +index 12cb7bdc..ec058a02 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_global_ssp/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_global_ssp/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the global_ssp SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_anon_write/rule.yml -index 43e73897..2fd9893d 100644 +index 19903fc9..31bf578d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the gluster_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_ro/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_ro/rule.yml -index 30fde508..b025346c 100644 +index c586752c..3eac3ab0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_ro/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_ro/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the gluster_export_all_ro SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_rw/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_rw/rule.yml -index 297f92f6..2fb4d168 100644 +index 953d6f51..445c6f2a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_rw/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_gluster_export_all_rw/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Configure the gluster_export_all_rw SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_gpg_web_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_gpg_web_anon_write/rule.yml -index 462281bb..9706856b 100644 +index fc5c20b9..5e4d075c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_gpg_web_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_gpg_web_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the gpg_web_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_gssd_read_tmp/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_gssd_read_tmp/rule.yml -index f29ec4bf..f6607de4 100644 +index 9cf94d26..fe53e4a3 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_gssd_read_tmp/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_gssd_read_tmp/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the gssd_read_tmp SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_guest_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_guest_exec_content/rule.yml -index e5d7e815..e03244c2 100644 +index fb0b8f6e..6b64581a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_guest_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_guest_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the guest_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_haproxy_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_haproxy_connect_any/rule.yml -index 8907de59..c6201008 100644 +index f5e5a38e..f96727ff 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_haproxy_connect_any/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_haproxy_connect_any/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the haproxy_connect_any SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_anon_write/rule.yml -index c5c4f1c3..3a84387a 100644 +index 7ac8bcac..8717ac94 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_builtin_scripting/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_builtin_scripting/rule.yml -index e0cb965a..5194c0c5 100644 +index 9d1fbe43..e2eef2ad 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_builtin_scripting/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_builtin_scripting/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Configure the httpd_builtin_scripting SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_check_spam/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_check_spam/rule.yml -index 2481c2b3..d91e9810 100644 +index f08b0711..4c2f3603 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_check_spam/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_check_spam/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_check_spam SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ftp/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ftp/rule.yml -index 82594b31..b4ac2f76 100644 +index 6511bfe2..6f07db4d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ftp/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ftp/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_connect_ftp SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ldap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ldap/rule.yml -index 85df4121..a92c59ea 100644 +index 9d088182..5f01b615 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ldap/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_ldap/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_connect_ldap SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_mythtv/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_mythtv/rule.yml -index 5e34e3db..85aeb364 100644 +index fe8400ee..c292070a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_mythtv/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_mythtv/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_connect_mythtv SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_zabbix/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_zabbix/rule.yml -index e3d6dff2..dbfd9567 100644 +index d8282606..3d80037c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_zabbix/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_connect_zabbix/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_connect_zabbix SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect/rule.yml -index 3a07d281..4365f676 100644 +index 51f2d075..ea465e8c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_cobbler/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_cobbler/rule.yml -index 4dd16248..d49b6a5b 100644 +index 04ffe7de..d45f0d7d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_cobbler/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_cobbler/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_network_connect_cobbler SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_db/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_db/rule.yml -index 65d7fe4a..eadf3608 100644 +index 38b2cbfe..2b40a15c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_db/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_connect_db/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_network_connect_db SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_memcache/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_memcache/rule.yml -index 91dac404..554fd538 100644 +index d844dcdb..d45a0031 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_memcache/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_memcache/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_network_memcache SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_relay/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_relay/rule.yml -index 684bc84e..757150b0 100644 +index bff3c8ce..8dad299f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_relay/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_network_relay/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_network_relay SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_sendmail/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_sendmail/rule.yml -index b6087598..522d2311 100644 +index 8d73dd26..3582c1a4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_sendmail/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_can_sendmail/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_can_sendmail SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_avahi/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_avahi/rule.yml -index 932d032f..66fd34b3 100644 +index 3cfbca8a..de20f874 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_avahi/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_avahi/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_dbus_avahi SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_sssd/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_sssd/rule.yml -index fb8ba251..f7000038 100644 +index da62291c..398bc8c7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_sssd/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dbus_sssd/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_dbus_sssd SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dontaudit_search_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dontaudit_search_dirs/rule.yml -index aaef3149..8d18efd0 100644 +index dc9651f9..2fec140e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dontaudit_search_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_dontaudit_search_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_dontaudit_search_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_cgi/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_cgi/rule.yml -index 3a7f808d..0f48bd53 100644 +index 63eb6e1e..21df0707 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_cgi/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_cgi/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Configure the httpd_enable_cgi SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_ftp_server/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_ftp_server/rule.yml -index 4d5a4f65..72e6a6ce 100644 +index 677ed3ce..4f1a4791 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_ftp_server/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_ftp_server/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_enable_ftp_server SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_homedirs/rule.yml -index 5a499936..fd0163d2 100644 +index a2b05231..c0d75670 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_homedirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_enable_homedirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_enable_homedirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_execmem/rule.yml -index 80cbfba0..77e87739 100644 +index ee05eba7..bf3793e5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_graceful_shutdown/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_graceful_shutdown/rule.yml -index 4e189e29..cce4ab17 100644 +index b5a42076..fd15c031 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_graceful_shutdown/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_graceful_shutdown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the httpd_graceful_shutdown SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_manage_ipa/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_manage_ipa/rule.yml -index 5ba2f80b..22b7f2d7 100644 +index d8453a7d..5fcb23b5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_manage_ipa/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_manage_ipa/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_manage_ipa SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_ntlm_winbind/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_ntlm_winbind/rule.yml -index 4d295d3e..63c04aed 100644 +index 0b2ad316..3347f027 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_ntlm_winbind/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_ntlm_winbind/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_mod_auth_ntlm_winbind SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_pam/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_pam/rule.yml -index 0305e797..4d892a02 100644 +index eaf8ea4d..2adfa1ac 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_pam/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_mod_auth_pam/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_mod_auth_pam SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_read_user_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_read_user_content/rule.yml -index 13a5b5c5..7101ec1f 100644 +index e258ff54..cf04e5bb 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_read_user_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_read_user_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_read_user_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_ipa/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_ipa/rule.yml -index 1af4ae47..0d51cb13 100644 +index d8b3f4e6..c17c8a97 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_ipa/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_ipa/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_run_ipa SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_preupgrade/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_preupgrade/rule.yml -index 4dd02763..9fdebb4a 100644 +index 413472cb..f96365f8 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_preupgrade/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_preupgrade/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_run_preupgrade SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_stickshift/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_stickshift/rule.yml -index db408caa..eb9a8846 100644 +index 4cc54284..3c320028 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_stickshift/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_run_stickshift/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_run_stickshift SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_serve_cobbler_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_serve_cobbler_files/rule.yml -index c54f61df..402455f8 100644 +index 27a979c8..6200f0a0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_serve_cobbler_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_serve_cobbler_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_serve_cobbler_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_setrlimit/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_setrlimit/rule.yml -index 148a248b..7ce925d0 100644 +index e09231f7..08f76037 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_setrlimit/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_setrlimit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_setrlimit SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_ssi_exec/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_ssi_exec/rule.yml -index c6f2551e..1e004457 100644 +index 81ee3798..c00302d0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_ssi_exec/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_ssi_exec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_ssi_exec SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_sys_script_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_sys_script_anon_write/rule.yml -index d8c0f8e4..555d597e 100644 +index 61140b8d..16585685 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_sys_script_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_sys_script_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_sys_script_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tmp_exec/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tmp_exec/rule.yml -index 4463d5d2..66625f57 100644 +index ad6c2ea7..c8a12f68 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tmp_exec/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tmp_exec/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_tmp_exec SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tty_comm/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tty_comm/rule.yml -index f8d32c4e..1d789ea2 100644 +index 12b4dcc1..04841fb3 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tty_comm/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_tty_comm/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_tty_comm SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_unified/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_unified/rule.yml -index 827d0cfd..0ac8d7b6 100644 +index ffcda8a2..364640ad 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_unified/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_unified/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_unified SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_cifs/rule.yml -index 02930c0f..5903b7e5 100644 +index 4a5c7bdc..88d0bf75 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_fusefs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_fusefs/rule.yml -index 5eea9592..f300e9f5 100644 +index 79c4149f..3df100b7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_fusefs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_fusefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_use_fusefs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_gpg/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_gpg/rule.yml -index 081e5f6a..f6f414a9 100644 +index d022811e..1e157cfa 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_gpg/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_gpg/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_use_gpg SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_nfs/rule.yml -index df5fcc66..b60a79ac 100644 +index 4080ca05..b872c1a8 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_openstack/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_openstack/rule.yml -index 58bd098d..0d10324e 100644 +index dbbb07cf..d0477e44 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_openstack/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_openstack/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_use_openstack SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_sasl/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_sasl/rule.yml -index e0dae7c0..d60958d5 100644 +index fe0840e2..f88ad485 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_sasl/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_use_sasl/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_use_sasl SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_verify_dns/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_verify_dns/rule.yml -index bd47bbc5..e534e9e7 100644 +index 61def0aa..6bfb1a2c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_verify_dns/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_httpd_verify_dns/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the httpd_verify_dns SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_icecast_use_any_tcp_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_icecast_use_any_tcp_ports/rule.yml -index 86f35028..4df61637 100644 +index 724cbbce..97bd40b0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_icecast_use_any_tcp_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_icecast_use_any_tcp_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the icecast_use_any_tcp_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_irc_use_any_tcp_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_irc_use_any_tcp_ports/rule.yml -index e2b1dca4..e0e3f0b5 100644 +index a7da73c3..66621010 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_irc_use_any_tcp_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_irc_use_any_tcp_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the irc_use_any_tcp_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_irssi_use_full_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_irssi_use_full_network/rule.yml -index 23a1b61f..6f93b6e1 100644 +index d82f9ff2..d14ca236 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_irssi_use_full_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_irssi_use_full_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the irssi_use_full_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_kdumpgui_run_bootloader/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_kdumpgui_run_bootloader/rule.yml -index 20fba259..ff3224fc 100644 +index fdb0a982..4573675c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_kdumpgui_run_bootloader/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_kdumpgui_run_bootloader/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the kdumpgui_run_bootloader SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_kerberos_enabled/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_kerberos_enabled/rule.yml -index ee6964c2..eb6c4b7a 100644 +index f154f106..e53861bb 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_kerberos_enabled/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_kerberos_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the kerberos_enabled SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_cifs/rule.yml -index 71677750..07d0e737 100644 +index eb32deaf..48b83090 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ksmtuned_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_nfs/rule.yml -index a02e146b..78f5bb6e 100644 +index 86376cba..74e8dfb6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ksmtuned_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the ksmtuned_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_logadm_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_logadm_exec_content/rule.yml -index 837b10c1..3c008341 100644 +index ec2cec98..dfe4a75d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_logadm_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_logadm_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the logadm_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_can_sendmail/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_can_sendmail/rule.yml -index 3a0d0533..8464de32 100644 +index dad98e38..b45bdc4b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_can_sendmail/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_can_sendmail/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the logging_syslogd_can_sendmail SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_run_nagios_plugins/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_run_nagios_plugins/rule.yml -index 5cbbcc68..3a3bb77e 100644 +index 3c520540..6acdf661 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_run_nagios_plugins/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_run_nagios_plugins/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the logging_syslogd_run_nagios_plugins SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_use_tty/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_use_tty/rule.yml -index 6e62e207..fdd3bafd 100644 +index b55c01f0..1b05386f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_use_tty/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_logging_syslogd_use_tty/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the logging_syslogd_use_tty SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_login_console_enabled/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_login_console_enabled/rule.yml -index 29bd516f..52fc04a2 100644 +index 1e423f46..064a77ef 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_login_console_enabled/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_login_console_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the login_console_enabled SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_logrotate_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_logrotate_use_nfs/rule.yml -index 6480418a..e5805d79 100644 +index 8e327772..e5b4122d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_logrotate_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_logrotate_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the logrotate_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_logwatch_can_network_connect_mail/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_logwatch_can_network_connect_mail/rule.yml -index 01ff4c6c..79f04a49 100644 +index d5e181b9..5da3e9c0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_logwatch_can_network_connect_mail/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_logwatch_can_network_connect_mail/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the logwatch_can_network_connect_mail SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_lsmd_plugin_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_lsmd_plugin_connect_any/rule.yml -index db118dc9..c9e334e5 100644 +index 4d3c7838..32b05be7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_lsmd_plugin_connect_any/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_lsmd_plugin_connect_any/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the lsmd_plugin_connect_any SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mailman_use_fusefs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mailman_use_fusefs/rule.yml -index 7208dbf9..0aec070f 100644 +index 6dfb2e01..5eb9727d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mailman_use_fusefs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mailman_use_fusefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mailman_use_fusefs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_client/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_client/rule.yml -index 2f859e14..34ccb4b5 100644 +index d235fe6f..95b28e43 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_client/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_client/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mcelog_client SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_exec_scripts/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_exec_scripts/rule.yml -index 5ab580ea..5482ddc1 100644 +index 46c9d61a..706520e3 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_exec_scripts/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_exec_scripts/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the mcelog_exec_scripts SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_foreground/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_foreground/rule.yml -index d0020a5f..aa96059d 100644 +index 80757940..86ada5a3 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_foreground/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_foreground/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mcelog_foreground SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_server/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_server/rule.yml -index 785a3b4a..bad09574 100644 +index 48cc45cb..8a59bf4c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_server/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mcelog_server/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mcelog_server SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_minidlna_read_generic_user_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_minidlna_read_generic_user_content/rule.yml -index 815ceb66..5aa36c09 100644 +index 040edc1f..068785b4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_minidlna_read_generic_user_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_minidlna_read_generic_user_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the minidlna_read_generic_user_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mmap_low_allowed/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mmap_low_allowed/rule.yml -index 41956c85..1117dd03 100644 +index 134cb824..52a2a0cb 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mmap_low_allowed/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mmap_low_allowed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the mmap_low_allowed SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mock_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mock_enable_homedirs/rule.yml -index 05719a62..f905fb1e 100644 +index 7302201a..9a1666c2 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mock_enable_homedirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mock_enable_homedirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the mock_enable_homedirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mount_anyfile/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mount_anyfile/rule.yml -index 5f8a6803..57104586 100644 +index 8354e36e..c85174c8 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mount_anyfile/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mount_anyfile/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the mount_anyfile SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_bind_unreserved_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_bind_unreserved_ports/rule.yml -index 47917c12..1739322d 100644 +index a461e301..5a57d162 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_bind_unreserved_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_bind_unreserved_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mozilla_plugin_bind_unreserved_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_can_network_connect/rule.yml -index 41247b12..8996027a 100644 +index b544dd12..17206906 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mozilla_plugin_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_bluejeans/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_bluejeans/rule.yml -index 0aa299ae..df1a5f62 100644 +index 878c10bd..69c810a9 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_bluejeans/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_bluejeans/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mozilla_plugin_use_bluejeans SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_gps/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_gps/rule.yml -index 10313318..b1895d06 100644 +index eba60ff3..66ab4c43 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_gps/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_gps/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mozilla_plugin_use_gps SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_spice/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_spice/rule.yml -index 36ec0868..b736d320 100644 +index a5655a34..ba398fec 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_spice/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_plugin_use_spice/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mozilla_plugin_use_spice SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_read_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_read_content/rule.yml -index b31818aa..beed2d5f 100644 +index 8d8407db..b56b3b40 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_read_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mozilla_read_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mozilla_read_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_enable_homedirs/rule.yml -index 764e4dc4..40548094 100644 +index db538e06..7c6f98ea 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_enable_homedirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_enable_homedirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mpd_enable_homedirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_cifs/rule.yml -index a979b22c..e0501614 100644 +index 5bff3c99..d359d281 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mpd_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_nfs/rule.yml -index bcba81eb..f746343e 100644 +index 97140465..a4af6e2d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mpd_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mpd_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mplayer_execstack/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mplayer_execstack/rule.yml -index 415da57a..5deb07f0 100644 +index bb5e5948..a412fc8b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mplayer_execstack/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mplayer_execstack/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mplayer_execstack SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_mysql_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_mysql_connect_any/rule.yml -index 655cd238..42eb6478 100644 +index 98a1ebcf..cce1c87e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_mysql_connect_any/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_mysql_connect_any/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the mysql_connect_any SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_pnp4nagios/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_pnp4nagios/rule.yml -index 829676a0..837a30be 100644 +index 70347807..2d91a12f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_pnp4nagios/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_pnp4nagios/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the nagios_run_pnp4nagios SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_sudo/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_sudo/rule.yml -index 5daed0ec..63442660 100644 +index 489a099a..7d208a85 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_sudo/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_nagios_run_sudo/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the nagios_run_sudo SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_named_tcp_bind_http_port/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_named_tcp_bind_http_port/rule.yml -index 7f665742..a2c31743 100644 +index a51fbbea..1f31780a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_named_tcp_bind_http_port/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_named_tcp_bind_http_port/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the named_tcp_bind_http_port SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_named_write_master_zones/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_named_write_master_zones/rule.yml -index 90f66209..c4bb709b 100644 +index c9d54a98..b4bb8d07 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_named_write_master_zones/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_named_write_master_zones/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the named_write_master_zones SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_neutron_can_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_neutron_can_network/rule.yml -index cdde885b..4e8c4345 100644 +index b543c733..3df85ab6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_neutron_can_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_neutron_can_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the neutron_can_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_ro/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_ro/rule.yml -index af9ffb1b..010d3a0a 100644 +index c0718a62..4ade28e7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_ro/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_ro/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the nfs_export_all_ro SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_rw/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_rw/rule.yml -index 55e97e8a..a9ce86bf 100644 +index 0355bad7..7d4a3dfc 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_rw/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_nfs_export_all_rw/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the nfs_export_all_rw SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_nfsd_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_nfsd_anon_write/rule.yml -index b1c6fdac..c0353213 100644 +index 8d21a80b..0b0a2ee5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_nfsd_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_nfsd_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the nfsd_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_nis_enabled/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_nis_enabled/rule.yml -index 598e6e78..0c01a81b 100644 +index 9ae527ee..b9324567 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_nis_enabled/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_nis_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the nis_enabled SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_nscd_use_shm/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_nscd_use_shm/rule.yml -index 7bbb60fd..0d2a91f8 100644 +index 2223ef84..abb41046 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_nscd_use_shm/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_nscd_use_shm/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the nscd_use_shm SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_openshift_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_openshift_use_nfs/rule.yml -index 0122a312..0eb95fb6 100644 +index 1c4fa8c1..9c06f296 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_openshift_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_openshift_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the openshift_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_can_network_connect/rule.yml -index 40f28c7f..e40cdb3d 100644 +index affa929a..b0ba05f1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the openvpn_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_enable_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_enable_homedirs/rule.yml -index 5d68295c..cf4e7436 100644 +index 425be626..20e4922a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_enable_homedirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_enable_homedirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the openvpn_enable_homedirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_run_unconfined/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_run_unconfined/rule.yml -index f2d44d69..1006c5fa 100644 +index 8ebfe542..04fcdf6d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_run_unconfined/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_openvpn_run_unconfined/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the openvpn_run_unconfined SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_bind_all_unreserved_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_bind_all_unreserved_ports/rule.yml -index e6c5857e..9de4c798 100644 +index c1a13523..fe23e776 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_bind_all_unreserved_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_bind_all_unreserved_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the pcp_bind_all_unreserved_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_read_generic_logs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_read_generic_logs/rule.yml -index 4e9862b9..4dbeb98b 100644 +index 9f902520..a76d4523 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_read_generic_logs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_pcp_read_generic_logs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the pcp_read_generic_logs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_piranha_lvs_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_piranha_lvs_can_network_connect/rule.yml -index 0b116122..df07be71 100644 +index bf1ea51c..3c76e1fc 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_piranha_lvs_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_piranha_lvs_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the piranha_lvs_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_connect_all_unreserved/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_connect_all_unreserved/rule.yml -index 534e069e..40d2dddc 100644 +index 7e628966..82442a13 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_connect_all_unreserved/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_connect_all_unreserved/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the polipo_connect_all_unreserved SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_bind_all_unreserved_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_bind_all_unreserved_ports/rule.yml -index 3d7823ff..1f84bcb0 100644 +index fa974402..39da107d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_bind_all_unreserved_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_bind_all_unreserved_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the polipo_session_bind_all_unreserved_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_users/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_users/rule.yml -index fe362726..87beeb2a 100644 +index f2f93ba3..2993b2f9 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_users/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_session_users/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the polipo_session_users SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_cifs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_cifs/rule.yml -index fdad8130..32d0873c 100644 +index 0f0fe5d6..bd263df1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_cifs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_cifs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the polipo_use_cifs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_nfs/rule.yml -index 367db106..f59de7cd 100644 +index 1c1d302e..7353b3ab 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_polipo_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the polipo_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_polyinstantiation_enabled/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_polyinstantiation_enabled/rule.yml -index b54d82a3..7f154a1a 100644 +index 53f154e7..969390fd 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_polyinstantiation_enabled/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_polyinstantiation_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the polyinstantiation_enabled SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_postfix_local_write_mail_spool/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_postfix_local_write_mail_spool/rule.yml -index 7d174222..0c078249 100644 +index 1c061280..f607bdc2 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_postfix_local_write_mail_spool/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_postfix_local_write_mail_spool/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the postfix_local_write_mail_spool SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_can_rsync/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_can_rsync/rule.yml -index 9d3f42dd..4d2d0deb 100644 +index 2d4f2e59..dcfcc5b4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_can_rsync/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_can_rsync/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the postgresql_can_rsync SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_transmit_client_label/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_transmit_client_label/rule.yml -index 345571d7..9bb6208b 100644 +index f7fdf042..e2bde893 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_transmit_client_label/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_transmit_client_label/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the postgresql_selinux_transmit_client_label SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_unconfined_dbadm/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_unconfined_dbadm/rule.yml -index c9d065f7..9833201a 100644 +index e4e888a8..0935fa0f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_unconfined_dbadm/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_unconfined_dbadm/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the postgresql_selinux_unconfined_dbadm SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_users_ddl/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_users_ddl/rule.yml -index 3a053f3a..b8ad0648 100644 +index 215daf93..c8f70c02 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_users_ddl/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_postgresql_selinux_users_ddl/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the postgresql_selinux_users_ddl SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_can_insmod/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_can_insmod/rule.yml -index 8483121b..ce86c8fc 100644 +index 9ff99173..6e8c37d1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_can_insmod/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_can_insmod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the pppd_can_insmod SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_for_user/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_for_user/rule.yml -index 96416d72..1751757b 100644 +index ef5d648f..a3f5a525 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_for_user/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_pppd_for_user/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the pppd_for_user SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_privoxy_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_privoxy_connect_any/rule.yml -index d5bb6b14..2de1b8b2 100644 +index b9f04990..320d69e0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_privoxy_connect_any/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_privoxy_connect_any/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the privoxy_connect_any SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_prosody_bind_http_port/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_prosody_bind_http_port/rule.yml -index 8451fe73..563fe230 100644 +index ec8fa105..3f3d870e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_prosody_bind_http_port/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_prosody_bind_http_port/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the prosody_bind_http_port SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetagent_manage_all_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetagent_manage_all_files/rule.yml -index a610ff18..879e441c 100644 +index ce7bc2f5..f1b87a1d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetagent_manage_all_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetagent_manage_all_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the puppetagent_manage_all_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetmaster_use_db/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetmaster_use_db/rule.yml -index 30db1743..72cfd812 100644 +index 894fed16..7f85d5e0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetmaster_use_db/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_puppetmaster_use_db/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the puppetmaster_use_db SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_racoon_read_shadow/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_racoon_read_shadow/rule.yml -index def236ff..1c0fa193 100644 +index 2cae0d28..4120691c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_racoon_read_shadow/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_racoon_read_shadow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the racoon_read_shadow SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_anon_write/rule.yml -index 59375fff..1aad03e7 100644 +index 8720c030..614c4e60 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the rsync_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_client/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_client/rule.yml -index 54c06cce..3c6e47ae 100644 +index 58878837..5ea8dc21 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_client/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_client/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the rsync_client SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_export_all_ro/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_export_all_ro/rule.yml -index 3c706484..f3fca2a8 100644 +index 154646cf..4aec9d3e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_export_all_ro/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_export_all_ro/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the rsync_export_all_ro SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_full_access/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_full_access/rule.yml -index fa843c92..34df7ad2 100644 +index 832dfa25..2de80cb7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_full_access/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_rsync_full_access/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the rsync_full_access SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_create_home_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_create_home_dirs/rule.yml -index d67c3a0f..d9bacf7c 100644 +index 85b65a88..207d77e8 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_create_home_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_create_home_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_create_home_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_domain_controller/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_domain_controller/rule.yml -index 0d4d6e76..21846ac8 100644 +index c67f1f86..8cd0f5e0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_domain_controller/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_domain_controller/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_domain_controller SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_enable_home_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_enable_home_dirs/rule.yml -index 88d8b687..e42e772c 100644 +index 1698ed1d..90798fe7 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_enable_home_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_enable_home_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_enable_home_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_ro/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_ro/rule.yml -index a7ec2a3d..9364f57c 100644 +index 9a21f5f6..b3efb3e9 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_ro/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_ro/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_export_all_ro SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_rw/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_rw/rule.yml -index d5c1b805..a80a88e5 100644 +index fd52c836..49a8ec85 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_rw/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_export_all_rw/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_export_all_rw SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_load_libgfapi/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_load_libgfapi/rule.yml -index e06e0fc7..08161747 100644 +index 826beddf..5a08118e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_load_libgfapi/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_load_libgfapi/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_load_libgfapi SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_portmapper/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_portmapper/rule.yml -index 48a07f1b..44ac4d1b 100644 +index d901e686..9073796e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_portmapper/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_portmapper/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_portmapper SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_run_unconfined/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_run_unconfined/rule.yml -index e0c780f5..defe3bc7 100644 +index c409c6bb..9729d7fa 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_run_unconfined/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_run_unconfined/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_run_unconfined SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_fusefs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_fusefs/rule.yml -index 52d25ff6..d75c0d2a 100644 +index cc2efcfb..707659d6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_fusefs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_fusefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_share_fusefs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_nfs/rule.yml -index 819ae315..be8a2763 100644 +index 085f7118..0230e13e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_samba_share_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the samba_share_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_fusefs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_fusefs/rule.yml -index effcaf70..831b0cf9 100644 +index 07428064..aa479f16 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_fusefs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_fusefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the sanlock_use_fusefs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_nfs/rule.yml -index 0294e81a..f576ec8b 100644 +index c1a64ba8..550a22a0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the sanlock_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_samba/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_samba/rule.yml -index 35100871..19c4918b 100644 +index c413f111..6b4110bf 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_samba/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_sanlock_use_samba/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the sanlock_use_samba SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_saslauthd_read_shadow/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_saslauthd_read_shadow/rule.yml -index 847144a3..e7c7ec7a 100644 +index f0d4bbc9..def16a42 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_saslauthd_read_shadow/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_saslauthd_read_shadow/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the saslauthd_read_shadow SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_secadm_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_secadm_exec_content/rule.yml -index 2773cae1..ac55ba22 100644 +index fe166c84..613e2054 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_secadm_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_secadm_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the secadm_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode/rule.yml -index 86565582..b96cd4d0 100644 +index 8812aab5..58433655 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the secure_mode SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_insmod/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_insmod/rule.yml -index 116da236..4ef94a3d 100644 +index 428bb90b..5416bfa6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_insmod/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_insmod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the secure_mode_insmod SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_policyload/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_policyload/rule.yml -index 95602971..2b583104 100644 +index cf06eb5e..a156f971 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_policyload/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_secure_mode_policyload/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the secure_mode_policyload SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_direct_dri_enabled/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_direct_dri_enabled/rule.yml -index 7211eac3..bbd6dee1 100644 +index d9918450..702adbee 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_direct_dri_enabled/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_direct_dri_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Configure the selinuxuser_direct_dri_enabled SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml -index d9a093f8..771c3d9b 100644 +index 79a5c0ec..d21be051 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execheap/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_execheap SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execmod/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execmod/rule.yml -index 8178f28e..90b0fde3 100644 +index f90ef118..bb0a2d7a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execmod/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execmod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the selinuxuser_execmod SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml -index 0a545953..81fcd388 100644 +index 7ae9bd9d..c8718a3b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_execstack/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'disable the selinuxuser_execstack SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_mysql_connect_enabled/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_mysql_connect_enabled/rule.yml -index e1d16d16..947aa3f8 100644 +index 273c5ac0..4a4a181c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_mysql_connect_enabled/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_mysql_connect_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_mysql_connect_enabled SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_ping/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_ping/rule.yml -index d07ffa2e..2cf64dab 100644 +index 0645deb5..36f1e961 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_ping/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_ping/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the selinuxuser_ping SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_postgresql_connect_enabled/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_postgresql_connect_enabled/rule.yml -index 62db4de0..ffc880bc 100644 +index b71a1ff7..17bb3478 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_postgresql_connect_enabled/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_postgresql_connect_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_postgresql_connect_enabled SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_rw_noexattrfile/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_rw_noexattrfile/rule.yml -index 193a6c0b..aa1eb675 100644 +index cc3ae761..45665fea 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_rw_noexattrfile/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_rw_noexattrfile/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_rw_noexattrfile SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_share_music/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_share_music/rule.yml -index a15bf88b..76ce2052 100644 +index 46b98953..118af784 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_share_music/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_share_music/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_share_music SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_tcp_server/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_tcp_server/rule.yml -index 29955b7d..7eb36328 100644 +index 692df86c..cb301be6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_tcp_server/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_tcp_server/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_tcp_server SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_udp_server/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_udp_server/rule.yml -index b0992267..10063b58 100644 +index 016131f1..f8ed8c83 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_udp_server/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_udp_server/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_udp_server SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_use_ssh_chroot/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_use_ssh_chroot/rule.yml -index 0dc63fdb..fd60d995 100644 +index 5fcf435e..49176ecf 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_use_ssh_chroot/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_selinuxuser_use_ssh_chroot/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the selinuxuser_use_ssh_chroot SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_domain_can_network_connect/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_domain_can_network_connect/rule.yml -index 639fcda9..1d2f2c2d 100644 +index 17054b75..da8b92c6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_domain_can_network_connect/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_domain_can_network_connect/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the sge_domain_can_network_connect SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_use_nfs/rule.yml -index 99f9959c..127af40f 100644 +index df44870b..1ad1905a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_sge_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the sge_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_smartmon_3ware/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_smartmon_3ware/rule.yml -index 5fbe9a9f..8657be40 100644 +index 03a20026..8496b412 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_smartmon_3ware/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_smartmon_3ware/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the smartmon_3ware SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_smbd_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_smbd_anon_write/rule.yml -index cd8cb0d0..1f5b05e4 100644 +index a597045a..b9f168ca 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_smbd_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_smbd_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the smbd_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_spamassassin_can_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_spamassassin_can_network/rule.yml -index 59c269ba..7cacd996 100644 +index 04514bde..570b320f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_spamassassin_can_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_spamassassin_can_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the spamassassin_can_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_spamd_enable_home_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_spamd_enable_home_dirs/rule.yml -index 40ae769a..1481b1f1 100644 +index 3f743cbf..32ec94a0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_spamd_enable_home_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_spamd_enable_home_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the spamd_enable_home_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_connect_any/rule.yml -index 13d9c595..12a44967 100644 +index ec5c45e7..6345f86a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_connect_any/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_connect_any/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the squid_connect_any SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_use_tproxy/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_use_tproxy/rule.yml -index 3c4161d3..67084531 100644 +index dd156deb..e39be3fd 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_use_tproxy/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_squid_use_tproxy/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the squid_use_tproxy SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_chroot_rw_homedirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_chroot_rw_homedirs/rule.yml -index bf36b6c9..637ef690 100644 +index ef2338c1..57cd8389 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_chroot_rw_homedirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_chroot_rw_homedirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the ssh_chroot_rw_homedirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_keysign/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_keysign/rule.yml -index 69c20fc1..0d95d1bb 100644 +index 5ab6b17e..ac0457bf 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_keysign/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_keysign/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the ssh_keysign SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_sysadm_login/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_sysadm_login/rule.yml -index 4d264e54..1b7b29d8 100644 +index f4b47393..96a9c991 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_sysadm_login/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_ssh_sysadm_login/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the ssh_sysadm_login SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_exec_content/rule.yml -index 0cd2cbbc..e58e1c07 100644 +index 6afbfdf2..761f9f99 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the staff_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_use_svirt/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_use_svirt/rule.yml -index 3a276af9..cc6b9390 100644 +index 4cb6582d..83c50aef 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_use_svirt/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_staff_use_svirt/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the staff_use_svirt SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_swift_can_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_swift_can_network/rule.yml -index fa9e3d25..9311180f 100644 +index 60ac4523..5bea5bed 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_swift_can_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_swift_can_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the swift_can_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_sysadm_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_sysadm_exec_content/rule.yml -index d0d798d3..5931458d 100644 +index d3dfd51e..3ba9d15d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_sysadm_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_sysadm_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the sysadm_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_connect_all_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_connect_all_ports/rule.yml -index 2a04d714..67dbd4c6 100644 +index d4d469d2..4ecc3659 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_connect_all_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_connect_all_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the telepathy_connect_all_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_tcp_connect_generic_network_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_tcp_connect_generic_network_ports/rule.yml -index e203eda5..90c9b5a5 100644 +index 1321809a..24257e70 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_tcp_connect_generic_network_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_telepathy_tcp_connect_generic_network_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the telepathy_tcp_connect_generic_network_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_anon_write/rule.yml -index 4485d50e..83082338 100644 +index 7d8a2cc2..a9448683 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the tftp_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_home_dir/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_home_dir/rule.yml -index 4d9cce1f..d79506fc 100644 +index 9b553ff7..e3b67bd5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_home_dir/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_tftp_home_dir/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the tftp_home_dir SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_nfs/rule.yml -index 0ca41b31..939dd046 100644 +index 1d6ea593..fe961347 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the tmpreaper_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_samba/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_samba/rule.yml -index f07f7b59..fe4b2724 100644 +index 0981d8bb..768670d4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_samba/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_tmpreaper_use_samba/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the tmpreaper_use_samba SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_bind_all_unreserved_ports/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_bind_all_unreserved_ports/rule.yml -index 5ae33cfc..82c99bc9 100644 +index df86f451..8f307e56 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_bind_all_unreserved_ports/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_bind_all_unreserved_ports/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the tor_bind_all_unreserved_ports SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_can_network_relay/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_can_network_relay/rule.yml -index 4ea25f13..32e1ef84 100644 +index 86e08e38..7e863ca9 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_can_network_relay/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_tor_can_network_relay/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the tor_can_network_relay SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_chrome_sandbox_transition/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_chrome_sandbox_transition/rule.yml -index c51f2c27..18b2c7a1 100644 +index f0556d17..b6c44d72 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_chrome_sandbox_transition/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_chrome_sandbox_transition/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the unconfined_chrome_sandbox_transition SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_login/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_login/rule.yml -index 73ce5a0a..98180272 100644 +index 403ec891..b2db23d6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_login/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_login/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the unconfined_login SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_mozilla_plugin_transition/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_mozilla_plugin_transition/rule.yml -index 2e7fce62..98efaf95 100644 +index d8f69ced..45d778d2 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_mozilla_plugin_transition/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_unconfined_mozilla_plugin_transition/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the unconfined_mozilla_plugin_transition SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_unprivuser_use_svirt/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_unprivuser_use_svirt/rule.yml -index b7774771..9d4a8ffc 100644 +index b9ea2bbe..cda7f281 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_unprivuser_use_svirt/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_unprivuser_use_svirt/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the unprivuser_use_svirt SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_ecryptfs_home_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_ecryptfs_home_dirs/rule.yml -index 91e29049..5ffe7588 100644 +index 7620ff49..224241b1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_ecryptfs_home_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_ecryptfs_home_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the use_ecryptfs_home_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_fusefs_home_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_fusefs_home_dirs/rule.yml -index af7e2d5c..7f53428f 100644 +index 0b74be73..fde9d57e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_fusefs_home_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_fusefs_home_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the use_fusefs_home_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_lpd_server/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_lpd_server/rule.yml -index fc5521f5..fee20da4 100644 +index ec79d2ec..dd36abc1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_lpd_server/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_lpd_server/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the use_lpd_server SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_nfs_home_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_nfs_home_dirs/rule.yml -index e27a0975..c7f9682e 100644 +index fdfad24e..8708942e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_nfs_home_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_nfs_home_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the use_nfs_home_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_samba_home_dirs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_samba_home_dirs/rule.yml -index 91d29d88..dd83aec0 100644 +index 4da19ea4..32b01588 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_use_samba_home_dirs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_use_samba_home_dirs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the use_samba_home_dirs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_user_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_user_exec_content/rule.yml -index c205cefc..76c25672 100644 +index ecb2e959..ea2e5df8 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_user_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_user_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Enable the user_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_varnishd_connect_any/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_varnishd_connect_any/rule.yml -index 309e8aba..2c0acbdd 100644 +index 0b2097dc..0619143c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_varnishd_connect_any/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_varnishd_connect_any/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the varnishd_connect_any SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_read_qemu_ga_data/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_read_qemu_ga_data/rule.yml -index 8469ba11..4cac8b62 100644 +index 7899bd3b..f7a88517 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_read_qemu_ga_data/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_read_qemu_ga_data/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_read_qemu_ga_data SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_rw_qemu_ga_data/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_rw_qemu_ga_data/rule.yml -index 14447887..a8ed5076 100644 +index 822b9894..8f57e4e5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_rw_qemu_ga_data/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_rw_qemu_ga_data/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_rw_qemu_ga_data SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_all_caps/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_all_caps/rule.yml -index 4e4fce65..a7de8365 100644 +index df5c0c82..559cd12b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_all_caps/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_all_caps/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_sandbox_use_all_caps SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_audit/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_audit/rule.yml -index 0df3ed21..1ad501c6 100644 +index f0009fe4..df761480 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_audit/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_audit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the virt_sandbox_use_audit SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_mknod/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_mknod/rule.yml -index 2f32f8b2..6bd93881 100644 +index 03b024c0..7689f05a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_mknod/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_mknod/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_sandbox_use_mknod SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_netlink/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_netlink/rule.yml -index 8be2b322..d81a086a 100644 +index 1891511d..3b80c5e8 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_netlink/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_netlink/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_sandbox_use_netlink SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_sys_admin/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_sys_admin/rule.yml -index eb77bc76..42fcdfe3 100644 +index b7fcd58a..a1577449 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_sys_admin/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_sandbox_use_sys_admin/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_sandbox_use_sys_admin SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_transition_userdomain/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_transition_userdomain/rule.yml -index dff84eb7..8cc2b16b 100644 +index 3a54abbb..25d71216 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_transition_userdomain/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_transition_userdomain/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_transition_userdomain SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_comm/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_comm/rule.yml -index aa39cff5..c79b847f 100644 +index bef0f9a8..901dc85e 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_comm/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_comm/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_comm SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_execmem/rule.yml -index 9fe91b1e..fc788b11 100644 +index b4c890c4..baa86e1b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_fusefs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_fusefs/rule.yml -index 31f18e0a..160351bd 100644 +index f92f814f..1ef74b8a 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_fusefs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_fusefs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_fusefs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_nfs/rule.yml -index 1e62cde0..50116c18 100644 +index 7db9e5b3..1e0cd0f5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_rawip/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_rawip/rule.yml -index 616f5969..c542fcc1 100644 +index ea059d54..23c6e632 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_rawip/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_rawip/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_rawip SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_samba/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_samba/rule.yml -index 4bd85cd0..527d0c4c 100644 +index bd6cccac..b664f299 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_samba/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_samba/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_samba SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_sanlock/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_sanlock/rule.yml -index ec76880c..064fa32e 100644 +index 7db733fe..9707ac1c 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_sanlock/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_sanlock/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_sanlock SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_usb/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_usb/rule.yml -index 51ae4c24..f29c1ecf 100644 +index bc2e3350..cb103a38 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_usb/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_usb/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_usb SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_xserver/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_xserver/rule.yml -index 1d2a0924..5a676c2a 100644 +index 8420fe49..ed9094f4 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_xserver/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_virt_use_xserver/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the virt_use_xserver SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_manage_user_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_manage_user_files/rule.yml -index 5389b1c1..65d05817 100644 +index 3d69f6b2..bf19fbb8 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_manage_user_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_manage_user_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the webadm_manage_user_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_read_user_files/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_read_user_files/rule.yml -index b5a06819..f17a0881 100644 +index c8859dd0..e0d5a9d1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_read_user_files/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_webadm_read_user_files/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the webadm_read_user_files SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_wine_mmap_zero_ignore/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_wine_mmap_zero_ignore/rule.yml -index 50da2c6d..bd6bfbdb 100644 +index 46ea5e90..f9940356 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_wine_mmap_zero_ignore/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_wine_mmap_zero_ignore/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the wine_mmap_zero_ignore SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_bind_vnc_tcp_port/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_bind_vnc_tcp_port/rule.yml -index 2fae8e58..f11b8087 100644 +index d777db4e..18d4819d 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_bind_vnc_tcp_port/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_bind_vnc_tcp_port/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xdm_bind_vnc_tcp_port SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_exec_bootloader/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_exec_bootloader/rule.yml -index 981bb5c2..ef6394ef 100644 +index 6200ed21..db68ab72 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_exec_bootloader/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_exec_bootloader/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xdm_exec_bootloader SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_sysadm_login/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_sysadm_login/rule.yml -index 81a94e25..520b405d 100644 +index 2142a35e..6fb378c1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_sysadm_login/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_sysadm_login/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xdm_sysadm_login SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_write_home/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_write_home/rule.yml -index e9a9a582..9b3cc2f7 100644 +index 19c1b27d..79b1a8af 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_write_home/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xdm_write_home/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xdm_write_home SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xen_use_nfs/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xen_use_nfs/rule.yml -index 9ce6183c..1def75b9 100644 +index 38ff90e0..c6fd91eb 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xen_use_nfs/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xen_use_nfs/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the xen_use_nfs SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_blktap/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_blktap/rule.yml -index 75dabac7..5206d486 100644 +index 9bd43515..8971006b 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_blktap/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_blktap/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the xend_run_blktap SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_qemu/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_qemu/rule.yml -index da3c989c..bb232fb7 100644 +index 1faef3c8..42a5a4f6 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_qemu/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xend_run_qemu/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Enable the xend_run_qemu SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_connect_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_connect_network/rule.yml -index cba7103a..f95d1f2a 100644 +index c289bd43..f1b137f3 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_connect_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_connect_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xguest_connect_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_exec_content/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_exec_content/rule.yml -index b816ab2b..3462d997 100644 +index 0ddc2fe7..ed411cee 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_exec_content/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_exec_content/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xguest_exec_content SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_mount_media/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_mount_media/rule.yml -index cc72497b..7e5311d8 100644 +index d58ed222..c0bee0ab 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_mount_media/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_mount_media/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xguest_mount_media SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_use_bluetooth/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_use_bluetooth/rule.yml -index fc8139a7..9604f3d4 100644 +index 3ecd6e32..51366088 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_use_bluetooth/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xguest_use_bluetooth/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xguest_use_bluetooth SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_clients_write_xshm/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_clients_write_xshm/rule.yml -index 9bb8a664..20c91dd2 100644 +index b1faac83..ca7e9e1f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_clients_write_xshm/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_clients_write_xshm/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xserver_clients_write_xshm SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_execmem/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_execmem/rule.yml -index 9ff72d3b..495c30bb 100644 +index dc0ff0f6..220222b0 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_execmem/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_execmem/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xserver_execmem SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_object_manager/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_object_manager/rule.yml -index bde9e8cc..3ae9f466 100644 +index 1e83bdc4..3aa38819 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_object_manager/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_xserver_object_manager/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Disable the xserver_object_manager SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_zabbix_can_network/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_zabbix_can_network/rule.yml -index 9d838bbc..75890c2f 100644 +index f48eccf1..ce7b6cac 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_zabbix_can_network/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_zabbix_can_network/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the zabbix_can_network SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_zarafa_setrlimit/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_zarafa_setrlimit/rule.yml -index 8a28b2aa..63d80946 100644 +index 4775f929..28113c1f 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_zarafa_setrlimit/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_zarafa_setrlimit/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the zarafa_setrlimit SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_zebra_write_config/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_zebra_write_config/rule.yml -index 6d5c2674..088fb3eb 100644 +index ede5e2a4..0159cace 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_zebra_write_config/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_zebra_write_config/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the zebra_write_config SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_anon_write/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_anon_write/rule.yml -index 04086918..8e6399a9 100644 +index f97013e6..ad916ea1 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_anon_write/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_anon_write/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the zoneminder_anon_write SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_run_sudo/rule.yml b/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_run_sudo/rule.yml -index 3d0dd1b6..13add29b 100644 +index dc7b1290..9596c2d5 100644 --- a/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_run_sudo/rule.yml +++ b/linux_os/guide/system/selinux/selinux-booleans/sebool_zoneminder_run_sudo/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: rhel7,rhel8,rhel9 ++prodtype: rhel7,rhel8,almalinux8,rhel9 title: 'Disable the zoneminder_run_sudo SELinux Boolean' diff --git a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml -index b2b94368..fbd86b87 100644 +index 50bd7f11..32b95cf4 100644 --- a/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml +++ b/linux_os/guide/system/selinux/selinux_all_devicefiles_labeled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Ensure No Device Files are Unlabeled by SELinux' diff --git a/linux_os/guide/system/selinux/selinux_confinement_of_daemons/rule.yml b/linux_os/guide/system/selinux/selinux_confinement_of_daemons/rule.yml -index d48b713a..a518bb93 100644 +index 6fb4c686..317b0949 100644 --- a/linux_os/guide/system/selinux/selinux_confinement_of_daemons/rule.yml +++ b/linux_os/guide/system/selinux/selinux_confinement_of_daemons/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Ensure No Daemons are Unconfined by SELinux' @@ -25398,26 +21010,26 @@ index d84c8acc..c4fec2c4 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/selinux/selinux_policytype/rule.yml b/linux_os/guide/system/selinux/selinux_policytype/rule.yml -index f7d6ce6b..be55a4d5 100644 +index cb717027..a5327538 100644 --- a/linux_os/guide/system/selinux/selinux_policytype/rule.yml +++ b/linux_os/guide/system/selinux/selinux_policytype/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Configure SELinux Policy' -@@ -49,7 +49,7 @@ references: - cobit5: APO01.06,APO11.04,APO13.01,BAI03.05,DSS01.05,DSS03.01,DSS05.02,DSS05.04,DSS05.05,DSS05.07,DSS06.02,DSS06.03,DSS06.06,MEA02.01 - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,3,4,5,6,8,9 +@@ -51,7 +51,7 @@ references: + srg: SRG-OS-000445-GPOS-00199 + stigid@ol7: OL07-00-020220 + stigid@rhel7: RHEL-07-020220 - stigid@rhel8: RHEL-08-010450 + stigid@almalinux8: RHEL-08-010450 + vmmsrg: SRG-OS-000445-VMM-001780 ocil_clause: 'it does not' - diff --git a/linux_os/guide/system/selinux/selinux_state/ansible/shared.yml b/linux_os/guide/system/selinux/selinux_state/ansible/shared.yml index 1c1560a8..fc86b614 100644 --- a/linux_os/guide/system/selinux/selinux_state/ansible/shared.yml @@ -25429,85 +21041,61 @@ index 1c1560a8..fc86b614 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/selinux/selinux_state/bash/shared.sh b/linux_os/guide/system/selinux/selinux_state/bash/shared.sh -index ad53e52a..8dcfb1ac 100644 +index 5286da83..9edb7521 100644 --- a/linux_os/guide/system/selinux/selinux_state/bash/shared.sh +++ b/linux_os/guide/system/selinux/selinux_state/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platorm_ol,multi_platform_rhv -+# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platorm_ol,multi_platform_rhv +-# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_wrlinux,multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # reboot = true # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/selinux/selinux_state/rule.yml b/linux_os/guide/system/selinux/selinux_state/rule.yml -index 0c4056df..08a026a9 100644 +index 94c21d9f..9ac4232a 100644 --- a/linux_os/guide/system/selinux/selinux_state/rule.yml +++ b/linux_os/guide/system/selinux/selinux_state/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 - - title: 'Ensure SELinux State is Enforcing' - -@@ -40,7 +40,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.12.1.1,A.12.1.2,A.12.4.1,A.12.4.2,A.12.4.3,A.12.4.4,A.12.7.1,A.13.1.1,A.13.1.2,A.13.1.3,A.13.2.1,A.13.2.2,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.1,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 1,11,12,13,14,15,16,18,3,4,5,6,8,9 - anssi: BP28(R4),BP28(R66) +@@ -43,7 +43,7 @@ references: + srg: SRG-OS-000445-GPOS-00199 + stigid@ol7: OL07-00-020210 + stigid@rhel7: RHEL-07-020210 - stigid@rhel8: RHEL-08-010170 + stigid@almalinux8: RHEL-08-010170 + vsrg: SRG-OS-000445-VMM-001780 ocil_clause: 'SELINUX is not set to enforcing' - diff --git a/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml b/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml -index 1a02b545..5b1f7b1e 100644 +index 8cf3c25c..0e9cad5e 100644 --- a/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml +++ b/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Map System Users To The Appropriate SELinux Role' diff --git a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml -index 8d5b722c..65d9b4c4 100644 +index cd07fb4c..c1a61ece 100644 --- a/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml +++ b/linux_os/guide/system/software/disk_partitioning/encrypt_partitions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,rhcos4,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,rhcos4,sle12 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Encrypt Partitions' -@@ -29,15 +29,6 @@ description: |- - with a minimum <tt>512</tt> bit key size which should be compatible with FIPS enabled. - {{% endif %}} - <br /><br /> -- Detailed information on encrypting partitions using LUKS or LUKS ciphers can be found on -- the {{{ full_name }}} Documentation web site:<br /> -- {{% if product in ["ol7", "ol8"] %}} -- {{{ weblink(link="https://docs.oracle.com/cd/E52668_01/E54670/html/ol7-encrypt-sec.html") }}}. -- {{% elif product == "sle12" %}} -- {{{ weblink(link="https://www.suse.com/documentation/sled-12/book_security/data/sec_security_cryptofs_y2.html") }}} -- {{% else %}} -- {{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html") }}}. -- {{% endif %}} - - rationale: |- - The risk of a system's physical compromise, particularly mobile systems such as -@@ -64,7 +55,7 @@ references: - cobit5: APO01.06,BAI02.01,BAI06.01,DSS04.07,DSS05.03,DSS05.04,DSS05.07,DSS06.02,DSS06.06 - cis-csc: 13,14 - stigid@sle12: SLES-12-010450 +@@ -71,7 +71,7 @@ references: + nist@sle12: SC-28,SC-28.1 + nist@sle15: SC-28,SC-28.1 + srg: SRG-OS-000405-GPOS-00184,SRG-OS-000185-GPOS-00079,SRG-OS-000404-GPOS-00183 - stigid@rhel8: RHEL-08-010030 + stigid@almalinux8: RHEL-08-010030 - - ocil_clause: 'partitions do not have a type of crypto_LUKS' - + stigid@sle12: SLES-12-010450 + stigid@sle15: SLES-15-010330 + stigid@ubuntu2004: UBTU-20-010414 diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_boot/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_boot/rule.yml index ab0fcaab..d4b587a3 100644 --- a/linux_os/guide/system/software/disk_partitioning/partition_for_boot/rule.yml @@ -25521,17 +21109,17 @@ index ab0fcaab..d4b587a3 100644 title: 'Ensure /boot Located On Separate Partition' diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_home/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_home/rule.yml -index 061eeae9..6b22489c 100644 +index 6c85e419..65562069 100644 --- a/linux_os/guide/system/software/disk_partitioning/partition_for_home/rule.yml +++ b/linux_os/guide/system/software/disk_partitioning/partition_for_home/rule.yml -@@ -37,7 +37,7 @@ references: - iso27001-2013: A.13.1.1,A.13.2.1,A.14.1.3 - cis-csc: 12,15,8 - cis@sle15: 1.1.14 +@@ -41,7 +41,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021310 + stigid@rhel7: RHEL-07-021310 - stigid@rhel8: RHEL-08-010800 + stigid@almalinux8: RHEL-08-010800 - - {{{ complete_ocil_entry_separate_partition(part="/home") }}} + stigid@sle12: SLES-12-010850 + stigid@sle15: SLES-15-040200 diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_opt/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_opt/rule.yml index 2c0e346b..f6f7f74c 100644 @@ -25546,13 +21134,13 @@ index 2c0e346b..f6f7f74c 100644 title: 'Ensure /opt Located On Separate Partition' diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_tmp/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_tmp/rule.yml -index a4db4948..0a24d72d 100644 +index 9689439f..27779714 100644 --- a/linux_os/guide/system/software/disk_partitioning/partition_for_tmp/rule.yml +++ b/linux_os/guide/system/software/disk_partitioning/partition_for_tmp/rule.yml -@@ -34,7 +34,7 @@ references: - iso27001-2013: A.13.1.1,A.13.2.1,A.14.1.3 - cis-csc: 12,15,8 - cis@sle15: 1.1.2 +@@ -36,7 +36,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021340 + stigid@rhel7: RHEL-07-021340 - stigid@rhel8: RHEL-08-010543 + stigid@almalinux8: RHEL-08-010543 @@ -25571,91 +21159,100 @@ index 0956cb88..26784d02 100644 title: 'Ensure /usr Located On Separate Partition' diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_var/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_var/rule.yml -index 8190a4a4..20ab2733 100644 +index 882d5138..1ec35261 100644 --- a/linux_os/guide/system/software/disk_partitioning/partition_for_var/rule.yml +++ b/linux_os/guide/system/software/disk_partitioning/partition_for_var/rule.yml -@@ -37,7 +37,7 @@ references: - iso27001-2013: A.13.1.1,A.13.2.1,A.14.1.3 - cis-csc: 12,15,8 - cis@sle15: 1.1.7 +@@ -40,7 +40,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021320 + stigid@rhel7: RHEL-07-021320 - stigid@rhel8: RHEL-08-010540 + stigid@almalinux8: RHEL-08-010540 - - {{{ complete_ocil_entry_separate_partition(part="/var") }}} - + stigid@sle12: SLES-12-010860 + stigid@sle15: SLES-15-040210 + vmmsrg: SRG-OS-000341-VMM-001220 diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_var_log/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_var_log/rule.yml -index 77ea8196..0f9b0040 100644 +index d2d9ce90..a47b87b8 100644 --- a/linux_os/guide/system/software/disk_partitioning/partition_for_var_log/rule.yml +++ b/linux_os/guide/system/software/disk_partitioning/partition_for_var_log/rule.yml -@@ -33,7 +33,7 @@ references: - cis-csc: 1,12,14,15,16,3,5,6,8 +@@ -37,7 +37,7 @@ references: + nist: CM-6(a),AU-4,SC-5(2) + nist-csf: PR.PT-1,PR.PT-4 srg: SRG-OS-000480-GPOS-00227 - cis@sle: 1.1.12 - stigid@rhel8: RHEL-08-010541 + stigid@almalinux8: RHEL-08-010541 {{{ complete_ocil_entry_separate_partition(part="/var/log") }}} diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_var_log_audit/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_var_log_audit/rule.yml -index 3ff8be67..8a200100 100644 +index cd6d83c8..d46302a3 100644 --- a/linux_os/guide/system/software/disk_partitioning/partition_for_var_log_audit/rule.yml +++ b/linux_os/guide/system/software/disk_partitioning/partition_for_var_log_audit/rule.yml -@@ -40,7 +40,7 @@ references: - cobit5: APO11.04,APO13.01,BAI03.05,BAI04.04,DSS05.02,DSS05.04,DSS05.07,MEA02.01 - cis-csc: 1,12,13,14,15,16,2,3,5,6,8 - cis@sle15: 1.1.13 +@@ -45,7 +45,7 @@ references: + srg: SRG-OS-000341-GPOS-00132,SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021330 + stigid@rhel7: RHEL-07-021330 - stigid@rhel8: RHEL-08-010542 + stigid@almalinux8: RHEL-08-010542 - - {{{ complete_ocil_entry_separate_partition(part="/var/log/audit") }}} - + stigid@sle12: SLES-12-010870 + stigid@sle15: SLES-15-030810 + vmmsrg: SRG-OS-000341-VMM-001220 diff --git a/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml b/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml -index 340af24c..85b93c3a 100644 +index d57c0f0c..1fe7a6d5 100644 --- a/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml +++ b/linux_os/guide/system/software/disk_partitioning/partition_for_var_tmp/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhcos4,sle15,ubuntu1804 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhcos4,sle15,ubuntu1804 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,sle15,ubuntu1804,ubuntu2004 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,sle15,ubuntu1804,ubuntu2004 title: 'Ensure /var/tmp Located On Separate Partition' +@@ -30,7 +30,7 @@ references: + cis@ubuntu1804: 1.1.6 + cis@ubuntu2004: 1.1.11 + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-010544 ++ stigid@almalinux8: RHEL-08-010544 + + {{{ complete_ocil_entry_separate_partition(part="/var/tmp") }}} + diff --git a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/bash/shared.sh b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/bash/shared.sh -index db06c9f5..78fa2bbd 100644 +index d24ad613..78e4f65c 100644 --- a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/bash/shared.sh @@ -1,3 +1,3 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_sle dconf update diff --git a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/rule.yml b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/rule.yml -index 3d37eee6..109b008b 100644 +index 2f0ab6a9..8b64b916 100644 --- a/linux_os/guide/system/software/gnome/dconf_db_up_to_date/rule.yml +++ b/linux_os/guide/system/software/gnome/dconf_db_up_to_date/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15 title: 'Make sure that the dconf databases are up-to-date with regards to respective keyfiles' diff --git a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/rule.yml b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/rule.yml -index d954668e..7fd1ade2 100644 +index ffde0523..c56b91c0 100644 --- a/linux_os/guide/system/software/gnome/enable_dconf_user_profile/rule.yml +++ b/linux_os/guide/system/software/gnome/enable_dconf_user_profile/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15,ubuntu2004 title: 'Configure GNOME3 DConf User Profile' diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/ansible/shared.yml -index a6066d34..04776bd2 100644 +index c3baa1b8..be83f158 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -25664,30 +21261,20 @@ index a6066d34..04776bd2 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/bash/shared.sh -index d09f54ac..5b1d6a38 100644 ---- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/bash/shared.sh -+++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol - - - {{{ bash_dconf_settings("org/gnome/login-screen", "disable-restart-buttons", "true", "gdm.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/rule.yml -index 58274f44..3b48899f 100644 +index 3165c09f..f2135e0b 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_restart_shutdown/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable the GNOME3 Login Restart and Shutdown Buttons' diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/ansible/shared.yml -index c4b757a4..66049602 100644 +index ca6beab0..8e18147d 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -25696,30 +21283,20 @@ index c4b757a4..66049602 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/bash/shared.sh -index 5b66d3f6..7795addd 100644 ---- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/bash/shared.sh -+++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol - - - {{{ bash_dconf_settings("org/gnome/login-screen", "disable-user-list", "true", "gdm.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/rule.yml -index 0dd463bb..e6a5dfe6 100644 +index f1f73151..012662c3 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_disable_user_list/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Disable the GNOME3 Login User List' diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/ansible/shared.yml -index a1cb94c4..118e0c63 100644 +index f5d68f1c..91f02c0d 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -25728,30 +21305,41 @@ index a1cb94c4..118e0c63 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/bash/shared.sh -index 2310ca7c..ee07e1a9 100644 ---- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/bash/shared.sh -+++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol - - - {{{ bash_dconf_settings("org/gnome/login-screen", "enable-smartcard-authentication", "true", "gdm.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/rule.yml -index c0ac9db8..b6dada19 100644 +index ce44e98c..1f66017c 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_enable_smartcard_auth/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Enable the GNOME3 Login Smartcard Authentication' +diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_lock_screen_on_smartcard_removal/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_lock_screen_on_smartcard_removal/rule.yml +index 4b5b1f9e..3a89e3fa 100644 +--- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_lock_screen_on_smartcard_removal/rule.yml ++++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_lock_screen_on_smartcard_removal/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 + + title: 'Enable the GNOME3 Screen Locking On Smartcard Removal' + +@@ -32,7 +32,7 @@ identifiers: + references: + disa: CCI-000056 + srg: SRG-OS-000028-GPOS-00009,SRG-OS-000030-GPOS-00011 +- stigid@rhel8: RHEL-08-020050 ++ stigid@almalinux8: RHEL-08-020050 + + ocil_clause: 'removal-action has not been configured' + diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/ansible/shared.yml -index a41844f1..d169befb 100644 +index 45e6c24a..e06d9600 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -25760,25 +21348,15 @@ index a41844f1..d169befb 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/bash/shared.sh -index 36df8ad6..af4316f9 100644 ---- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/bash/shared.sh -+++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol - - - {{{ bash_dconf_settings("org/gnome/login-screen", "allowed-failures" "3" "gdm.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/rule.yml -index c85f0706..620f8307 100644 +index baf8f8a1..6bede2b8 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/dconf_gnome_login_retries/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Set the GNOME3 Login Number of Failures' @@ -25803,26 +21381,26 @@ index 63faca98..b6bf6e6e 100644 if rpm --quiet -q gdm then diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_automatic_login/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_automatic_login/rule.yml -index 0594702a..1f428176 100644 +index 98d000a2..f9b9a04d 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_automatic_login/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_automatic_login/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,sle12 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,sle12 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12 title: 'Disable GDM Automatic Login' @@ -39,7 +39,7 @@ references: - cobit5: BAI10.01,BAI10.02,BAI10.03,BAI10.05 - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 + srg: SRG-OS-000480-GPOS-00229 + stigid@ol7: OL07-00-010440 + stigid@rhel7: RHEL-07-010440 - stigid@rhel8: RHEL-08-010820 + stigid@almalinux8: RHEL-08-010820 + stigid@sle12: SLES-12-010380 ocil_clause: 'GDM allows users to automatically login' - diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_guest_login/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_guest_login/ansible/shared.yml index ef2933c5..0d72f6f6 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_guest_login/ansible/shared.yml @@ -25844,7 +21422,7 @@ index 569fccfa..b89d4cc5 100644 if rpm --quiet -q gdm then diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_guest_login/rule.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_guest_login/rule.yml -index 4d2915f4..cdb60270 100644 +index 2d7584c3..b260701c 100644 --- a/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_guest_login/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_login_screen/gnome_gdm_disable_guest_login/rule.yml @@ -1,6 +1,6 @@ @@ -25865,120 +21443,104 @@ index 0ca67c74..332a5018 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml b/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml -index 8e8b32f1..55d983ac 100644 ---- a/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml -+++ b/linux_os/guide/system/software/gnome/gnome_login_screen/group.yml -@@ -8,11 +8,6 @@ description: |- - login automatically and/or with a guest account. The login screen should be configured - to prevent such behavior. - <br /><br /> -- {{% if product in ["ol7", "ol8"] %}} - For more information about enforcing preferences in the GNOME3 environment using the DConf - configuration system, see <b>{{{ weblink(link="http://wiki.gnome.org/dconf") }}}</b> and - the man page <tt>dconf(1)</tt>. -- {{% else %}} -- For more information about enforcing preferences in the GNOME3 environment using the DConf -- configuration system, see <b>{{{ weblink(link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Desktop_Migration_and_Administration_Guide/index.html") }}}/></b> and the man page <tt>dconf(1)</tt>. -- {{% endif %}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/ansible/shared.yml -index 5a3c30d4..a63bdbc1 100644 +index 60417ff4..0af05e79 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol # reboot = false # strategy = unknown # complexity = low diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/bash/shared.sh -index 5a521536..a7b333f6 100644 +index 140c1cfc..9ba03ca1 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol {{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount", "false", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/rule.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/rule.yml -index eb56d946..5fef4aaf 100644 +index a5271bc5..9e0dc115 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable GNOME3 Automounting' diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/ansible/shared.yml -index e0c9aedc..6c3fab55 100644 +index ac168ef9..69ecfa6a 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol # reboot = false # strategy = unknown # complexity = low diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/bash/shared.sh -index 7a149750..136dbe20 100644 +index 7e2c64e5..fc18909f 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol {{{ bash_dconf_settings("org/gnome/desktop/media-handling", "automount-open", "false", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/rule.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/rule.yml -index f14363a3..45e79fbe 100644 +index 8283802e..0612d84c 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_automount_open/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable GNOME3 Automount Opening' diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml -index 7f01df14..da34df52 100644 +index 51e4063c..3591b726 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol # reboot = false # strategy = unknown # complexity = low diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh -index 4c3bcb95..6b82ace0 100644 +index 97a63e90..ae5872e4 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol {{{ bash_dconf_settings("org/gnome/desktop/media-handling", "autorun-never", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/rule.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/rule.yml -index 41c28174..fab46df6 100644 +index efefee40..198fd42b 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_autorun/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable GNOME3 Automount running' diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/ansible/shared.yml -index a4da19fe..67ef50e2 100644 +index d9084479..bd866343 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -25998,19 +21560,19 @@ index 66768c6d..39bfef95 100644 {{{ bash_dconf_settings("org/gnome/desktop/thumbnailers", "disable-all", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/rule.yml b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/rule.yml -index 3348fbeb..08dd9951 100644 +index cfaad53a..94454d77 100644 --- a/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_media_settings/dconf_gnome_disable_thumbnailers/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 title: 'Disable All GNOME3 Thumbnailers' diff --git a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/ansible/shared.yml -index 22200f64..d434d71f 100644 +index d82d2741..d7eca57d 100644 --- a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26030,19 +21592,19 @@ index 9cc91fdc..6a1abf0d 100644 {{{ bash_dconf_settings("org/gnome/nm-applet", "disable-wifi-create", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/rule.yml b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/rule.yml -index 6e88631d..ae230db1 100644 +index 739ce837..82376091 100644 --- a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_create/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 title: 'Disable WIFI Network Connection Creation in GNOME3' diff --git a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/ansible/shared.yml -index 4b5a4687..e7ebb245 100644 +index 416732d6..dfd0a49e 100644 --- a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26062,19 +21624,19 @@ index 49e3f7e6..60d65868 100644 {{{ bash_dconf_settings("org/gnome/nm-applet", "suppress-wireless-networks-available", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/rule.yml b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/rule.yml -index 75479d95..e31d930d 100644 +index 0d8eb600..96d42b6b 100644 --- a/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_network_settings/dconf_gnome_disable_wifi_notification/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 title: 'Disable WIFI Network Notification in GNOME3' diff --git a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/ansible/shared.yml -index 2472417c..7cb3fb85 100644 +index 809ef3f0..75d3cb88 100644 --- a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26094,19 +21656,19 @@ index cfc0001b..78509b32 100644 {{{ bash_dconf_settings("org/gnome/Vino", "authentication-methods", "['vnc']", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/rule.yml b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/rule.yml -index bdb4eb1e..62a5478a 100644 +index 084253ec..fbe7c8e1 100644 --- a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_credential_prompt/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Require Credential Prompting for Remote Access in GNOME3' diff --git a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/ansible/shared.yml -index 63af198e..a636ca22 100644 +index 74bd3c9d..1b9c33c8 100644 --- a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26126,19 +21688,19 @@ index b10508ed..ea64385e 100644 {{{ bash_dconf_settings("org/gnome/Vino", "require-encryption", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/rule.yml b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/rule.yml -index 5b3558a4..d510d679 100644 +index 3ad1ce2f..6dd55745 100644 --- a/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_remote_access_settings/dconf_gnome_remote_access_encryption/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Require Encryption for Remote Access in GNOME3' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/ansible/shared.yml -index 8b3d0342..02644248 100644 +index c9dcad48..4f475886 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26158,19 +21720,19 @@ index 9c89da66..1386946e 100644 {{{ bash_dconf_settings("org/gnome/desktop/screensaver", "idle-activation-enabled", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/rule.yml -index 4071329c..b03bc2d0 100644 +index 459747a2..93842287 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Enable GNOME3 Screensaver Idle Activation' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/ansible/shared.yml -index 0247f8ad..e8f57199 100644 +index d3f144c8..ae170b80 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26190,24 +21752,24 @@ index 59a3bafa..d3c18c8d 100644 {{{ bash_dconf_lock("org/gnome/desktop/screensaver", "idle-activation-enabled", "local.d", "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/rule.yml -index 2d0e7108..d96da897 100644 +index b94df803..aaa45d94 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_activation_locked/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure Users Cannot Change GNOME3 Screensaver Idle Activation' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml -index 05663ecf..7ef97783 100644 +index 962fff57..bf9af4c0 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -26222,28 +21784,28 @@ index ab0462e5..e9b3f8c1 100644 {{{ bash_instantiate_variables("inactivity_timeout_value") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/rule.yml -index cd33cd5b..5a17c8b9 100644 +index 56f4436b..cace974d 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_idle_delay/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15 title: 'Set GNOME3 Screensaver Inactivity Timeout' -@@ -48,7 +48,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 +@@ -53,7 +53,7 @@ references: + srg: SRG-OS-000029-GPOS-00010 + stigid@ol7: OL07-00-010070 + stigid@rhel7: RHEL-07-010070 - stigid@rhel8: RHEL-08-020060 + stigid@almalinux8: RHEL-08-020060 - - ocil_clause: 'idle-delay is not equal to or less than the expected value' + stigid@sle12: SLES-12-010080 + stigid@sle15: SLES-15-010120 diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml -index a901c245..99f460f8 100644 +index ab219dc4..e303520d 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26263,24 +21825,24 @@ index 5c37b1d9..8d6c0e21 100644 {{{ bash_instantiate_variables("var_screensaver_lock_delay") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/rule.yml -index d8a59655..b77695c3 100644 +index 46d19003..1b2e9db5 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_delay/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Set GNOME3 Screensaver Lock Delay After Activation Period' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml -index 2159f329..41f353f5 100644 +index 292bcf8f..bdba6192 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_sle # reboot = false # strategy = unknown # complexity = low @@ -26295,28 +21857,28 @@ index 5a516b50..3b749d90 100644 {{{ bash_dconf_settings("org/gnome/desktop/screensaver", "lock-enabled", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/rule.yml -index aa492e1c..74248b6d 100644 +index 49f1d387..e966e091 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15,ubuntu2004 title: 'Enable GNOME3 Screensaver Lock After Idle Period' -@@ -43,7 +43,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.4,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16 +@@ -55,7 +55,7 @@ references: + srg: SRG-OS-000028-GPOS-00009,SRG-OS-000030-GPOS-00011 + stigid@ol7: OL07-00-010060 + stigid@rhel7: RHEL-07-010060 - stigid@rhel8: RHEL-08-020030 + stigid@almalinux8: RHEL-08-020030 - - ocil_clause: 'screensaver locking is not enabled and/or has not been set or configured correctly' - + stigid@sle12: SLES-12-010060 + stigid@sle15: SLES-15-010100 + stigid@ubuntu2004: UBTU-20-010004 diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml -index bb784e2c..685e6c94 100644 +index 34ff91ab..875abf68 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26336,51 +21898,51 @@ index ea46be4f..4385f506 100644 {{{ bash_dconf_lock("org/gnome/desktop/screensaver", "lock-enabled", "local.d", "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/rule.yml -index 8267a04f..dc6b4e06 100644 +index 4b9770e1..04dea645 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_lock_locked/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure Users Cannot Change GNOME3 Screensaver Lock After Idle Period' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml -index 818874f3..2e608658 100644 +index 4dbe2b3c..7313b6bc 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_sle # reboot = false # strategy = unknown # complexity = low diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh -index 8dc079f7..14eafa50 100644 +index 19666f52..d1c6eaeb 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_sle {{{ bash_dconf_settings("org/gnome/desktop/screensaver", "picture-uri", "string ''", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/rule.yml -index b1a6ed79..e3208183 100644 +index 4ac56470..d16064f2 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_mode_blank/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15 title: 'Implement Blank Screensaver' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/ansible/shared.yml -index 47fc886c..9d7e04d7 100644 +index 606e00c5..792db4ca 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26400,19 +21962,19 @@ index 9e563568..b81d73fd 100644 {{{ bash_dconf_settings("org/gnome/desktop/screensaver", "show-full-name-in-top-bar", "false", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/rule.yml -index 3b70ff28..e4264ab3 100644 +index 9f86c7ed..556d1227 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_info/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Full User Name on Splash Shield' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml -index f6ed794d..e5de51d6 100644 +index ed7d9884..a41cb715 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26432,19 +21994,19 @@ index 7e540988..6baf65b4 100644 {{{ bash_dconf_lock("org/gnome/desktop/screensaver", "lock-delay", "local.d", "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/rule.yml -index 2cf9857a..cce1e1a3 100644 +index d0173ce6..66020289 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_screensaver_user_locks/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure Users Cannot Change GNOME3 Screensaver Settings' diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml -index 700b6d29..1bc0cf43 100644 +index aae97c96..18c7ec75 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26464,60 +22026,60 @@ index 8f4922b5..3478e9c9 100644 {{{ bash_dconf_lock("org/gnome/desktop/session", "idle-delay", "local.d", "00-security-settings-lock") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/rule.yml b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/rule.yml -index f0744412..b3b6001e 100644 +index cbe3e082..5d4750c7 100644 --- a/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_screen_locking/dconf_gnome_session_idle_user_locks/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Ensure Users Cannot Change GNOME3 Session Idle Settings' diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml -index 82b5623e..4c2ad58e 100644 +index 76181547..eb340cb5 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/ansible/shared.yml @@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol # reboot = false # strategy = unknown # complexity = low diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh -index ea1d6b88..0a1e0978 100644 +index 6bdb2e67..8218dfbe 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora +-# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol ++# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol {{{ bash_dconf_settings("org/gnome/settings-daemon/plugins/media-keys", "logout", "''", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml -index d89bc407..68de6950 100644 +index 36e7ed1e..9b192608 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,ubuntu2004 title: 'Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3' -@@ -45,7 +45,7 @@ references: - iso27001-2013: A.10.1.1,A.11.1.4,A.11.1.5,A.11.2.1,A.13.1.1,A.13.1.3,A.13.2.1,A.13.2.3,A.13.2.4,A.14.1.2,A.14.1.3,A.6.1.2,A.7.1.1,A.7.1.2,A.7.3.1,A.8.2.2,A.8.2.3,A.9.1.1,A.9.1.2,A.9.2.3,A.9.4.1,A.9.4.4,A.9.4.5 - cis-csc: 12,13,14,15,16,18,3,5 +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020231 stigid@rhel7: RHEL-07-020231 - stigid@rhel8: RHEL-08-040171 + stigid@almalinux8: RHEL-08-040171 + stigid@ubuntu2004: UBTU-20-010459 ocil_clause: 'GNOME3 is configured to reboot when Ctrl-Alt-Del is pressed' - diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/ansible/shared.yml -index 53138129..977b66cd 100644 +index 71f1ed93..19e07ca5 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/ansible/shared.yml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -26537,58 +22099,38 @@ index ffa7d125..4bca3f4d 100644 {{{ bash_dconf_settings("org/gnome/system/location", "enabled", "false", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/rule.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/rule.yml -index 92aa1136..0936600c 100644 +index 051d4f13..b9def751 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_geolocation/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Geolocation in GNOME3' diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_power_settings/rule.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_power_settings/rule.yml -index 78d44cdf..d806b553 100644 +index 7a2e35b8..8d2debf7 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_power_settings/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_power_settings/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,rhel7,rhel8,almalinux8 +-prodtype: fedora,rhel7,rhel8,rhel9 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9 title: 'Disable Power Settings in GNOME3' -diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/ansible/shared.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/ansible/shared.yml -index f31fc597..d5f844c7 100644 ---- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/ansible/shared.yml -+++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/ansible/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol -+# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol - # reboot = false - # strategy = unknown - # complexity = low -diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/bash/shared.sh b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/bash/shared.sh -index a3e88e2d..e3973afb 100644 ---- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/bash/shared.sh -+++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol - - - {{{ bash_dconf_settings("org/gnome/desktop/lockdown", "user-administration-disabled", "true", "local.d", "00-security-settings") }}} diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/rule.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/rule.yml -index a585809a..bcb4d992 100644 +index 592f8558..664c876c 100644 --- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/rule.yml +++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_user_admin/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Disable User Administration in GNOME3' @@ -26606,26 +22148,26 @@ index 27b2e8e2..b93c5bcf 100644 <br /><br /> For more information on GNOME and the GNOME Project, see <b>{{{ weblink(link="https://www.gnome.org") }}}</b>. diff --git a/linux_os/guide/system/software/gnome/package_gdm_removed/rule.yml b/linux_os/guide/system/software/gnome/package_gdm_removed/rule.yml -index cdf34d43..59994c10 100644 +index 65a915de..e6a694e9 100644 --- a/linux_os/guide/system/software/gnome/package_gdm_removed/rule.yml +++ b/linux_os/guide/system/software/gnome/package_gdm_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,rhv4 -+prodtype: fedora,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,rhel7,rhel8,rhel9,rhv4,ubuntu2004 ++prodtype: fedora,rhel7,rhel8,almalinux8,rhel9,rhv4,ubuntu2004 title: 'Remove the GDM Package Group' diff --git a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_FIPS_certified/rule.yml b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_FIPS_certified/rule.yml -index 48f65177..ee3dd478 100644 +index 56edcdee..6251f5f9 100644 --- a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_FIPS_certified/rule.yml +++ b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_FIPS_certified/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15 +-prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux8,ubuntu1604,ubuntu1804,ubuntu2004,wrlinux1019 ++prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux8,ubuntu1604,ubuntu1804,ubuntu2004,wrlinux1019 title: 'The Installed Operating System Is FIPS 140-2 Certified' @@ -26642,14 +22184,14 @@ index 931be7e8..17fe400d 100644 <extend_definition comment="Installed OS is RHEL8" definition_ref="installed_OS_is_rhel8" /> <extend_definition comment="Installed OS is OL7" definition_ref="installed_OS_is_ol7_family" /> diff --git a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml -index fba676f0..a3766aad 100644 +index dc40925c..3ffb4713 100644 --- a/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml +++ b/linux_os/guide/system/software/integrity/certified-vendor/installed_OS_is_vendor_supported/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,wrlinux1019 title: 'The Installed Operating System Is Vendor Supported' @@ -26663,16 +22205,16 @@ index fba676f0..a3766aad 100644 {{% else %}} Red Hat Enterprise Linux is supported by Red Hat, Inc. As the Red Hat Enterprise Linux vendor, Red Hat, Inc. is responsible for providing security patches. -@@ -42,7 +45,7 @@ references: - nist-csf: ID.RA-1,PR.IP-12 +@@ -48,7 +51,7 @@ references: srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020250 stigid@rhel7: RHEL-07-020250 - stigid@rhel8: RHEL-08-010000 + stigid@almalinux8: RHEL-08-010000 stigid@sle12: SLES-12-010000 - isa-62443-2009: 4.2.3,4.2.3.12,4.2.3.7,4.2.3.9 - cobit5: APO12.01,APO12.02,APO12.03,APO12.04,BAI03.10,DSS05.01,DSS05.02 -@@ -58,6 +61,8 @@ ocil: |- + stigid@sle15: SLES-15-010000 + +@@ -61,6 +64,8 @@ ocil: |- <pre>$ grep -i "red hat" /etc/redhat-release</pre> {{% elif product in ["ol7", "ol8"] %}} <pre>$ grep -i "oracle" /etc/oracle-release</pre> @@ -26681,547 +22223,609 @@ index fba676f0..a3766aad 100644 {{% elif product in ["sle12", "sle15"] %}} <pre>$ grep -i "suse" /etc/os-release</pre> {{% endif %}} -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/bash/shared.sh -index bbe14199..1709db74 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - - function remediate_bind_crypto_policy() { - CONFIG_FILE="/etc/named.conf" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/rule.yml -index 37ee1ced..d3ff892c 100644 +index 5484e11a..69ca3426 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: 'Configure BIND to use System Crypto Policy' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/absent.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/absent.fail.sh -index 89ff8c70..d47c3175 100644 +index 2c9316c3..ff0480eb 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/absent.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/absent.fail.sh @@ -1,6 +1,6 @@ #!/bin/bash # packages = bind --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 BIND_CONF='/etc/named.conf' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/bind_not_installed.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/bind_not_installed.pass.sh -index cd87ae3f..9ebf9beb 100644 +index eeee56ba..ef03fc9a 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/bind_not_installed.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/bind_not_installed.pass.sh @@ -1,4 +1,4 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 yum remove -y bind || true diff --git a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/no_config_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/no_config_file.fail.sh -index 82e4df78..e0f97da7 100644 +index 98b91d69..b647f75c 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/no_config_file.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/no_config_file.fail.sh @@ -1,7 +1,7 @@ #!/bin/bash # packages = bind # --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # We don't remediate anything if the config file is missing completely. # remediation = none diff --git a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/ok.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/ok.pass.sh -index 98417056..3fd63e3c 100644 +index 6218d35e..ea8f9062 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/ok.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/ok.pass.sh @@ -1,6 +1,6 @@ #!/bin/bash # packages = bind --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 BIND_CONF='/etc/named.conf' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/overrides.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/overrides.fail.sh -index e30e126b..a31068d2 100644 +index 1efeb70a..1be51e61 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/overrides.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_bind_crypto_policy/tests/overrides.fail.sh @@ -1,6 +1,6 @@ #!/bin/bash # packages = bind --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 BIND_CONF='/etc/named.conf' -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/ansible/shared.yml -index 09b6dbc8..47aa3417 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/ansible/shared.yml -+++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/ansible/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - # reboot = false - # strategy = restrict - # complexity = low -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/bash/shared.sh -index d37f1263..7fa0db54 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - - # include remediation functions library - . /usr/share/scap-security-guide/remediation_functions diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml -index e6053913..2152a392 100644 +index d4ea4db6..7b804682 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: 'Configure System Cryptography Policy' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_and_current_same_time.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_and_current_same_time.pass.sh -index bde213f9..7cfa1623 100644 +index 4169dff3..c0dfdaf2 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_and_current_same_time.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_and_current_same_time.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # IMPORTANT: This is a false negative scenario. # File /etc/crypto-policies/config can be newer than /etc/crypto-policies/state/current, diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_newer_than_current.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_newer_than_current.fail.sh -index d4dbf9c1..fccb7a6c 100644 +index 833cc166..c5556090 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_newer_than_current.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/config_newer_than_current.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 update-crypto-policies --set "DEFAULT" sleep 1s diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_nss_config.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_nss_config.fail.sh -index 69d14931..7663005c 100644 +index 5bc60832..d9f4b97b 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_nss_config.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_nss_config.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_ospp update-crypto-policies --set "FIPS:OSPP" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy.fail.sh -index b3f80441..2b8d9e09 100644 +index 0db03331..e0688ec0 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_ospp, xccdf_org.ssgproject.content_profile_standard sed -i "1d" /etc/crypto-policies/config diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy_file.fail.sh -index 88aceae8..2ab30614 100644 +index fe431fb7..8842dc5f 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy_file.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/missing_policy_file.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_ospp, xccdf_org.ssgproject.content_profile_standard rm /etc/crypto-policies/state/current diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_file.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_file.pass.sh -index 439dacff..76982f3c 100644 +index 709714c8..71f718c4 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_file.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_file.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_ospp update-crypto-policies --set "FIPS:OSPP" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_symlink.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_symlink.pass.sh -index 4deaa265..38890ba9 100644 +index fc6bb8b5..c60a96a6 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_symlink.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/nss_config_as_symlink.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_ospp update-crypto-policies --set "FIPS:OSPP" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_nosha1_set.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_nosha1_set.pass.sh -index b4acc304..972ab6f0 100644 +index d083ceb1..88e9d939 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_nosha1_set.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_nosha1_set.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_e8 update-crypto-policies --set "DEFAULT:NO-SHA1" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_set.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_set.pass.sh -index b918e7ae..f65b4797 100644 +index 49e1f08d..f30ee6b4 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_set.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_default_set.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_standard update-crypto-policies --set "DEFAULT" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_fips_ospp_set.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_fips_ospp_set.pass.sh -index 8e311609..77ec5882 100644 +index 54b8211c..7b94bb56 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_fips_ospp_set.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/policy_fips_ospp_set.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_ospp update-crypto-policies --set "FIPS:OSPP" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/wrong_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/wrong_policy.fail.sh -index 789caa81..8a3b2369 100644 +index 926d3c12..ca368933 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/wrong_policy.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_crypto_policy/tests/wrong_policy.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # profiles = xccdf_org.ssgproject.content_profile_ospp, xccdf_org.ssgproject.content_profile_standard sed -i "1s/.*/LEGACY/" /etc/crypto-policies/config -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/ansible/shared.yml -index 0e0bb79a..e0315df6 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/ansible/shared.yml -+++ b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/ansible/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - # reboot = true - # strategy = configure - # complexity = low -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/bash/shared.sh -index be869edf..feedc09b 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - # reboot = true - # strategy = configure - # complexity = low +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/rule.yml +index 354f216b..7aed7424 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/rule.yml ++++ b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8,fedora ++prodtype: rhel8,almalinux8,fedora + + title: 'Configure GnuTLS library to use DoD-approved TLS Encryption' + +@@ -28,7 +28,7 @@ references: + disa: CCI-001453 + nist: AC-17(2) + srg: SRG-OS-000250-GPOS-00093,SRG-OS-000423-GPOS-00187 +- stigid@rhel8: RHEL-08-010295 ++ stigid@almalinux8: RHEL-08-010295 + + ocil_clause: 'cryptographic policy for gnutls is not configured or is configured incorrectly' + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/correct.pass.sh +index 3c964c53..52245efc 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/correct.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/gnutls.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/empty_policy.fail.sh +index 5c006cec..dfde03fb 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/empty_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/empty_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/gnutls.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/incorrect_policy.fail.sh +index 7a82fe62..b51aacb7 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/incorrect_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/incorrect_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/gnutls.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/missing_file.fail.sh +index ad39b47d..e4ca9f99 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/missing_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_gnutls_tls_crypto_policy/tests/missing_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/gnutls.config + diff --git a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/rule.yml -index fe713aa6..d792b7bb 100644 +index b219c9d2..003375a1 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: 'Configure Kerberos to use System Crypto Policy' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_correct_policy.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_correct_policy.pass.sh -index abbb0b5e..d1f44392 100644 +index 677aa91c..3bcda12d 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_correct_policy.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_correct_policy.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 rm -f /etc/krb5.conf.d/crypto-policies ln -s /etc/crypto-policies/back-ends/krb5.config /etc/krb5.conf.d/crypto-policies diff --git a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_missing_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_missing_policy.fail.sh -index 143e90ae..961b4487 100644 +index 2c0cb3be..f73e155e 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_missing_policy.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_missing_policy.fail.sh @@ -1,4 +1,4 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 rm -f /etc/krb5.conf.d/crypto-policies diff --git a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_wrong_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_wrong_policy.fail.sh -index fa05c359..f5577ee0 100644 +index 842fb7b4..99563741 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_wrong_policy.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_kerberos_crypto_policy/tests/kerberos_wrong_policy.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 rm -f /etc/krb5.conf.d/crypto-policies ln -s /etc/crypto-policies/back-ends/openssh.config /etc/krb5.conf.d/crypto-policies -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/ansible/shared.yml -index c529966c..c6e86eb6 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/ansible/shared.yml -+++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/ansible/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - # reboot = false - # strategy = restrict - # complexity = low -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/bash/shared.sh -index ade7563b..f7448342 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - - function remediate_libreswan_crypto_policy() { - CONFIG_FILE="/etc/ipsec.conf" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/rule.yml -index 01d6f681..c6726d4d 100644 +index d54ccaae..0bb7929d 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: 'Configure Libreswan to use System Crypto Policy' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/libreswan_not_installed.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/libreswan_not_installed.pass.sh -index cea521f6..e58dfa38 100644 +index 32a820e0..c7a7793a 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/libreswan_not_installed.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/libreswan_not_installed.pass.sh @@ -1,4 +1,4 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 yum remove -y libreswan || true diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_commented.fail.sh -index e9457003..67235305 100644 +index dda7430c..c45d1fa4 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_commented.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_commented.fail.sh @@ -1,6 +1,6 @@ #!/bin/bash # packages = libreswan --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 cp ipsec.conf /etc diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_is_there.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_is_there.pass.sh -index 1d493db1..0c5d1bf0 100644 +index c74f70dc..a58740ee 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_is_there.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_is_there.pass.sh @@ -1,6 +1,6 @@ #!/bin/bash # packages = libreswan --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 cp ipsec.conf /etc diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_not_there.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_not_there.fail.sh -index de6bc16f..30ef6815 100644 +index a8f9df03..89803c89 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_not_there.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/line_not_there.fail.sh @@ -1,6 +1,6 @@ #!/bin/bash # packages = libreswan --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 cp ipsec.conf /etc diff --git a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/wrong_value.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/wrong_value.fail.sh -index bfec1e0c..1ece3fd6 100644 +index 1ef57ed1..804d7dd7 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/wrong_value.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_libreswan_crypto_policy/tests/wrong_value.fail.sh @@ -1,6 +1,6 @@ #!/bin/bash # packages = libreswan --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 cp ipsec.conf /etc -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml -index 986543c1..2474ec6d 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml -+++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - # reboot = false - # strategy = unknown - # complexity = low -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh -index a0b30cce..74c3c53a 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - - OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]' - OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/rule.yml -index 49989867..1654980f 100644 +index 9cf7e69b..db290ad6 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: 'Configure OpenSSL library to use System Crypto Policy' +@@ -29,7 +29,7 @@ references: + nerc-cip: CIP-003-3 R4.2,CIP-007-3 R5.1,CIP-007-3 R7.1 + nist: AC-17(a),AC-17(2),CM-6(a),MA-4(6),SC-13,SC-12(2),SC-12(3) + srg: SRG-OS-000250-GPOS-00093 +- stigid@rhel8: RHEL-08-010293 ++ stigid@almalinux8: RHEL-08-010293 + + ocil_clause: |- + the OpenSSL config file doesn't contain the whole section, diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/nothing.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/nothing.fail.sh -index 58405c87..17bc6857 100644 +index e424e796..abff84c2 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/nothing.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/nothing.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 . common.sh diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/ok.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/ok.pass.sh -index 0322165c..4740dd89 100644 +index 2c1ad0db..00112ea7 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/ok.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/ok.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 . common.sh diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/section_not_include.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/section_not_include.fail.sh -index fe02074f..e6b21b04 100644 +index d758cdb2..32d98127 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/section_not_include.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/section_not_include.fail.sh @@ -1,5 +1,5 @@ #!/bin/bash --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 . common.sh diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/wrong.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/wrong.fail.sh -index 24c0556d..03710708 100644 +index 7f0c394f..653de38d 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/wrong.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/wrong.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 + + . common.sh + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/rule.yml +index 4a777989..f5aa09b0 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/rule.yml ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8,rhel9 ++prodtype: rhel8,almalinux8,rhel9 + + title: 'Configure OpenSSL library to use TLS Encryption' + +@@ -28,7 +28,7 @@ references: + disa: CCI-001453 + nist: AC-17(2) + srg: SRG-OS-000250-GPOS-00093 +- stigid@rhel8: RHEL-08-010294 ++ stigid@almalinux8: RHEL-08-010294 + + ocil_clause: 'cryptographic policy for openssl is not configured or is configured incorrectly' + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct.pass.sh +index 13513cb4..60ddb8a9 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct.pass.sh @@ -1,5 +1,5 @@ #!/bin/bash -# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 +# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 - . common.sh + configfile=/etc/crypto-policies/back-ends/opensslcnf.config -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/ansible/shared.yml -index f92a496e..dc1009e9 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/ansible/shared.yml -+++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/ansible/shared.yml -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 - # reboot = true - # strategy = disable - # complexity = low -diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/bash/shared.sh -index 7f288499..65f1800b 100644 ---- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8,Red Hat Virtualization 4 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8,Red Hat Virtualization 4 +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_commented.fail.sh +index 96d8ce78..78e4ae08 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_commented.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_commented.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 - SSH_CONF="/etc/sysconfig/sshd" + configfile=/etc/crypto-policies/back-ends/opensslcnf.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_followed_by_incorrect.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_followed_by_incorrect.fail.sh +index 8be710e2..1b609a09 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_followed_by_incorrect.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/correct_followed_by_incorrect.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/opensslcnf.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/empty_policy.fail.sh +index 04409d51..76c29e61 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/empty_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/empty_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/opensslcnf.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_followed_by_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_followed_by_correct.pass.sh +index ae4f3c0c..a44d71a7 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_followed_by_correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_followed_by_correct.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/opensslcnf.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_policy.fail.sh +index fe410552..e1184893 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/incorrect_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/opensslcnf.config + +diff --git a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/missing_file.fail.sh +index 7a3b7c32..0eddf01d 100644 +--- a/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/missing_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/configure_openssl_tls_crypto_policy/tests/missing_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + + configfile=/etc/crypto-policies/back-ends/opensslcnf.config diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml -index 51788a32..52ebf21d 100644 +index ffe4a707..603ab6e9 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8,rhv4,rhcos4 -+prodtype: fedora,ol8,rhel8,almalinux8,rhv4,rhcos4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: 'Configure SSH to use System Crypto Policy' diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/absent.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/absent.pass.sh -index 46d05574..411e71ef 100644 +index 0076833e..98facaf0 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/absent.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/absent.pass.sh @@ -1,6 +1,6 @@ #!/bin/bash # --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 SSH_CONF="/etc/sysconfig/sshd" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/comment.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/comment.pass.sh -index d53cb4db..3e9ad10b 100644 +index da414e21..a95c2912 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/comment.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/comment.pass.sh @@ -1,6 +1,6 @@ #!/bin/bash # --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 SSH_CONF="/etc/sysconfig/sshd" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/no_config_file.pass.sh b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/no_config_file.pass.sh -index da769b5d..346433e4 100644 +index 1e8762ff..a05ff03d 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/no_config_file.pass.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/no_config_file.pass.sh @@ -1,6 +1,6 @@ #!/bin/bash # --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 SSH_CONF="/etc/sysconfig/sshd" diff --git a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/overrides.fail.sh b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/overrides.fail.sh -index 371f8aa2..2befcc1b 100644 +index d3e1eb9e..e6900a3b 100644 --- a/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/overrides.fail.sh +++ b/linux_os/guide/system/software/integrity/crypto/configure_ssh_crypto_policy/tests/overrides.fail.sh @@ -1,6 +1,6 @@ #!/bin/bash # --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 SSH_CONF="/etc/sysconfig/sshd" @@ -27236,7 +22840,7 @@ index d5c2c2b9..355c89d5 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/bash/shared.sh -index be6f84f8..5ee6dcd4 100644 +index cd7c4fb6..1deb135a 100644 --- a/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/bash/shared.sh @@ -1,4 +1,4 @@ @@ -27244,9 +22848,9 @@ index be6f84f8..5ee6dcd4 100644 +# platform = Oracle Linux 8,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora cp="Ciphersuites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" - file=/etc/crypto-policies/local.d/opensslcnf-ospp.config + file="/etc/crypto-policies/local.d/opensslcnf-ospp.config" diff --git a/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/rule.yml -index f8fc85ae..8be6fcff 100644 +index f7dd2528..b1764526 100644 --- a/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/harden_openssl_crypto_policy/rule.yml @@ -1,6 +1,6 @@ @@ -27334,16 +22938,6 @@ index 7a3b7c32..0eddf01d 100644 configfile=/etc/crypto-policies/back-ends/opensslcnf.config -diff --git a/linux_os/guide/system/software/integrity/crypto/harden_ssh_client_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_ssh_client_crypto_policy/bash/shared.sh -index 0222388f..4846cce0 100644 ---- a/linux_os/guide/system/software/integrity/crypto/harden_ssh_client_crypto_policy/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/crypto/harden_ssh_client_crypto_policy/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = Oracle Linux 8,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_fedora -+# platform = Oracle Linux 8,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_fedora - - #the file starts with 02 so that it is loaded before the 05-redhat.conf which activates configuration provided by system vide crypto policy - file="/etc/ssh/ssh_config.d/02-ospp.conf" diff --git a/linux_os/guide/system/software/integrity/crypto/harden_ssh_client_crypto_policy/tests/commented_cipher.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_ssh_client_crypto_policy/tests/commented_cipher.fail.sh index 17bf0e67..c633df0b 100644 --- a/linux_os/guide/system/software/integrity/crypto/harden_ssh_client_crypto_policy/tests/commented_cipher.fail.sh @@ -27641,6 +23235,211 @@ index b6ff5881..5198a648 100644 file="/etc/ssh/ssh_config.d/02-ospp.conf" echo -e "Match final all\n\ +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/ansible/shared.yml +index 956a19f3..8c4ad2c9 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/ansible/shared.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/bash/shared.sh +index cdc66a8a..997ed727 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/bash/shared.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + . /usr/share/scap-security-guide/remediation_functions + {{{ bash_instantiate_variables("sshd_approved_ciphers") }}} + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml +index 682ca436..8cb3e3fb 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8 ++prodtype: fedora,rhel8,almalinux8 + + title: 'Configure SSH Client to Use FIPS 140-2 Validated Ciphers: openssh.config' + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct.pass.sh +index 0a27a7e0..9d1613f3 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_ciphers=aes256-ctr,aes192-ctr,aes128-ctr +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh +index 5cadd95b..ef215bad 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_ciphers=aes256-ctr,aes192-ctr,aes128-ctr +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh +index 26220063..ccb19599 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_ciphers=aes256-ctr,aes192-ctr,aes128-ctr +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh +index 55ef3f58..b379631a 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/openssh.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh +index 7105441a..ab012d8a 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/openssh.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh +index 6ad1f4fd..6f73c2b6 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_ciphers=aes256-ctr,aes192-ctr,aes128-ctr +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh +index 92bd4ed9..df4b63d7 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + incorrect_sshd_approved_ciphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh +index 2138caad..50b1b349 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/openssh.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/ansible/shared.yml +index 3e637f37..e86f8c4c 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/ansible/shared.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/bash/shared.sh +index eaa4463c..986fa499 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/bash/shared.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + . /usr/share/scap-security-guide/remediation_functions + {{{ bash_instantiate_variables("sshd_approved_ciphers") }}} + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml +index e904bc84..fb641b5e 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8 ++prodtype: rhel8,almalinux8 + + title: 'Configure SSH Server to Use FIPS 140-2 Validated Ciphers: opensshserver.config' + +@@ -30,7 +30,7 @@ references: + disa: CCI-001453 + nist: AC-17(2) + srg: SRG-OS-000250-GPOS-00093 +- stigid@rhel8: RHEL-08-010291 ++ stigid@almalinux8: RHEL-08-010291 + + ocil_clause: 'Crypto Policy for OpenSSH Server is not configured correctly' + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh +index 1a8911d5..fff3b756 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_ciphers=aes256-ctr,aes192-ctr,aes128-ctr +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh +index 3dde1479..3c0b9110 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/opensshserver.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh +index f97f54db..a8d0ef50 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/opensshserver.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh +index 11e596ce..b2301c45 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_ciphers_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/opensshserver.config diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/bash/shared.sh index 7a9a2a5e..25cf3fd3 100644 --- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/bash/shared.sh @@ -27651,6 +23450,18 @@ index 7a9a2a5e..25cf3fd3 100644 cp="CRYPTO_POLICY='-oCiphers=aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc -oMACs=hmac-sha2-512,hmac-sha2-256 -oGSSAPIKeyExchange=no -oKexAlgorithms=ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256 -oPubkeyAcceptedKeyTypes=rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256'" file=/etc/crypto-policies/local.d/opensshserver-ospp.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/rule.yml +index 80ab3ffe..8b3d3f57 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/rule.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,sle12,sle15,rhv4 ++prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,sle12,sle15,rhv4 + + title: 'Harden SSHD Crypto Policy' + diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/tests/correct.pass.sh index d0541b7a..e3f47684 100644 --- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_crypto_policy/tests/correct.pass.sh @@ -27739,26 +23550,231 @@ index 1928d2cf..6914ed91 100644 configfile=/etc/crypto-policies/back-ends/opensshserver.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml +index 1c9dde77..152d2d39 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh +index b26992ce..0846b6ce 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + . /usr/share/scap-security-guide/remediation_functions + {{{ bash_instantiate_variables("sshd_approved_macs") }}} + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml +index d21f68ac..4ad71ae6 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: fedora,rhel8 ++prodtype: fedora,rhel8,almalinux8 + + title: 'Configure SSH Client to Use FIPS 140-2 Validated MACs: openssh.config' + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh +index 5a4b6887..2211658c 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_macs=hmac-sha2-512,hmac-sha2-256 +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh +index e713d254..2ee92db0 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_commented.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_macs=hmac-sha2-512,hmac-sha2-256 +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh +index b8a63bec..1bed4c1e 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_correct_followed_by_incorrect_commented.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_macs=hmac-sha2-512,hmac-sha2-256 +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh +index 55ef3f58..b379631a 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/openssh.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh +index 9980a456..c46aa761 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_empty_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/openssh.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh +index d1303d60..7a90058d 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_followed_by_correct_commented.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_macs=hmac-sha2-512,hmac-sha2-256 +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh +index 8b21af46..93a148d1 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_incorrect_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/openssh.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh +index 2138caad..50b1b349 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_openssh_conf_crypto_policy/tests/stig_missing_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_fedora,Red Hat Enterprise Linux 8 ++# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/openssh.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml +index 5ed61858..7a69caf3 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + # reboot = true + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh +index 790a2951..81d971a6 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = Red Hat Enterprise Linux 8,multi_platform_fedora ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora + . /usr/share/scap-security-guide/remediation_functions + {{{ bash_instantiate_variables("sshd_approved_macs") }}} + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml +index 0fd107a1..3144ec44 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel8 ++prodtype: rhel8,almalinux8 + + title: 'Configure SSH Server to Use FIPS 140-2 Validated MACs: opensshserver.config' + +@@ -28,7 +28,7 @@ references: + disa: CCI-001453 + nist: AC-17(2) + srg: SRG-OS-000250-GPOS-00093 +- stigid@rhel8: RHEL-08-010290 ++ stigid@almalinux8: RHEL-08-010290 + + ocil_clause: 'Crypto Policy for OpenSSH Server is not configured correctly' + +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh +index 14da9221..59606fb0 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_correct.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + sshd_approved_macs=hmac-sha2-512,hmac-sha2-256 +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh +index 3dde1479..3c0b9110 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_empty_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/opensshserver.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh +index a50a0fc0..027fcba0 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_incorrect_policy.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/opensshserver.config +diff --git a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh +index 11e596ce..b2301c45 100644 +--- a/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh ++++ b/linux_os/guide/system/software/integrity/crypto/harden_sshd_macs_opensshserver_conf_crypto_policy/tests/rhel8_stig_missing_file.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = Red Hat Enterprise Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 + # profiles = xccdf_org.ssgproject.content_profile_stig + + configfile=/etc/crypto-policies/back-ends/opensshserver.config diff --git a/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/bash/shared.sh b/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/bash/shared.sh -index d8c99350..a7db3346 100644 +index beec02c9..878ed4ce 100644 --- a/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Oracle Linux 8 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 cat > /etc/profile.d/openssl-rand.sh <<- 'EOM' {{{ openssl_strong_entropy_config_file() }}} diff --git a/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/rule.yml b/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/rule.yml -index d98526e4..51472607 100644 +index ccd4752c..1e51025c 100644 --- a/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/openssl_use_strong_entropy/rule.yml @@ -1,7 +1,7 @@ documentation_complete: true # TODO: The plan is not to need this for RHEL>=8.4 --prodtype: rhel8 -+prodtype: rhel8,almalinux8 +-prodtype: ol8,rhel8 ++prodtype: ol8,rhel8,almalinux8 title: 'OpenSSL uses strong entropy source' @@ -27794,38 +23810,17 @@ index 7034224c..19393e1d 100644 echo "wrong data" > /etc/profile.d/openssl-rand.sh diff --git a/linux_os/guide/system/software/integrity/crypto/package_crypto-policies_installed/rule.yml b/linux_os/guide/system/software/integrity/crypto/package_crypto-policies_installed/rule.yml -index bde69a1b..c22c229f 100644 +index 68ce3979..5460c879 100644 --- a/linux_os/guide/system/software/integrity/crypto/package_crypto-policies_installed/rule.yml +++ b/linux_os/guide/system/software/integrity/crypto/package_crypto-policies_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol8,rhel8 -+prodtype: ol8,rhel8,almalinux8 +-prodtype: ol8,rhel8,rhel9 ++prodtype: ol8,rhel8,almalinux8,rhel9 title: 'Install crypto-policies package' -diff --git a/linux_os/guide/system/software/integrity/crypto/ssh_client_rekey_limit/rule.yml b/linux_os/guide/system/software/integrity/crypto/ssh_client_rekey_limit/rule.yml -index e054892d..f86d3927 100644 ---- a/linux_os/guide/system/software/integrity/crypto/ssh_client_rekey_limit/rule.yml -+++ b/linux_os/guide/system/software/integrity/crypto/ssh_client_rekey_limit/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: rhel8,rhcos4 -+prodtype: rhel8,almalinux8,rhcos4 - - title: 'Configure session renegotiation for SSH client' - -@@ -31,7 +31,7 @@ identifiers: - references: - ospp: FCS_SSHS_EXT.1 - srg: SRG-OS-000423-GPOS-00187 -- stigid@rhel8: RHEL-08-040162 -+ stigid@almalinux8: RHEL-08-040162 - - ocil_clause: 'it is commented out or is not set' - diff --git a/linux_os/guide/system/software/integrity/disable_prelink/ansible/shared.yml b/linux_os/guide/system/software/integrity/disable_prelink/ansible/shared.yml index 1ac4527f..563cc96b 100644 --- a/linux_os/guide/system/software/integrity/disable_prelink/ansible/shared.yml @@ -27837,7 +23832,7 @@ index 1ac4527f..563cc96b 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/install_antivirus/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/install_antivirus/rule.yml -index fc1f0d91..04c61d06 100644 +index 264d2f94..14cc99d5 100644 --- a/linux_os/guide/system/software/integrity/endpoint_security_software/install_antivirus/rule.yml +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/install_antivirus/rule.yml @@ -1,6 +1,6 @@ @@ -27849,19 +23844,19 @@ index fc1f0d91..04c61d06 100644 title: 'Install Virus Scanning Software' diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/rule.yml -index c12bbb35..db8a241b 100644 +index eb01fb01..11c89647 100644 --- a/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/rule.yml +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhel7,rhel8,rhv4 -+prodtype: fedora,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install Intrusion Detection Software' diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/install_mcafee_antivirus/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/install_mcafee_antivirus/rule.yml -index 68e974d8..5c46a849 100644 +index 78b9bdee..9a60ee12 100644 --- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/install_mcafee_antivirus/rule.yml +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/install_mcafee_antivirus/rule.yml @@ -1,6 +1,6 @@ @@ -27885,7 +23880,7 @@ index 6e9f3bcb..a89f3228 100644 title: 'Install the McAfee Runtime Libraries and Linux Agent' diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_antivirus_definitions_updated/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_antivirus_definitions_updated/rule.yml -index 92c84953..844fd9d8 100644 +index dc856f8b..a5561435 100644 --- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_antivirus_definitions_updated/rule.yml +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_antivirus_definitions_updated/rule.yml @@ -1,6 +1,6 @@ @@ -27896,44 +23891,74 @@ index 92c84953..844fd9d8 100644 title: 'Virus Scanning Software Definitions Are Updated' +diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml +index 32c93446..28b73eaa 100644 +--- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml ++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/agent_mfetpd_running/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel7,rhel8 ++prodtype: rhel7,rhel8,almalinux8 + + title: 'Ensure McAfee Endpoint Security for Linux (ENSL) is running' + +@@ -24,7 +24,7 @@ references: + nist: SI-2(2) + srg: SRG-OS-000191-GPOS-00080 + stigid@rhel7: RHEL-07-020019 +- stigid@rhel8: RHEL-08-010001 ++ stigid@almalinux8: RHEL-08-010001 + + ocil_clause: 'virus scanning software is not running' + +diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml +index 4c7dc8d7..914c90f6 100644 +--- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml ++++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_endpoint_security_software/package_mcafeetp_installed/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: rhel7,rhel8 ++prodtype: rhel7,rhel8,almalinux8 + + title: 'Install McAfee Endpoint Security for Linux (ENSL)' + +@@ -26,7 +26,7 @@ references: + nist: SI-2(2) + srg: SRG-OS-000191-GPOS-00080 + stigid@rhel7: RHEL-07-020019 +- stigid@rhel8: RHEL-08-010001 ++ stigid@almalinux8: RHEL-08-010001 + + ocil_clause: 'the package is not installed' + diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_accm/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_accm/rule.yml -index 0707fe44..99cdf980 100644 +index 3208a697..bd68f3a2 100644 --- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_accm/rule.yml +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_accm/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8 title: 'Install the Asset Configuration Compliance Module (ACCM)' diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_pa/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_pa/rule.yml -index a237befa..3a88b4d0 100644 +index 7bdc4fa8..8fb1bd7e 100644 --- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_pa/rule.yml +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/install_mcafee_hbss_pa/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8 title: 'Install the Policy Auditor (PA) Module' -diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml -index 9dc7e3ca..0654c2a3 100644 ---- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml -+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/mcafee_hbss_software/package_MFEhiplsm_installed/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhv4,sle12,sle15 -+prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhv4,sle12,sle15 - - title: 'Install the Host Intrusion Prevention System (HIPS) Module' - diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/service_nails_enabled/rule.yml b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/service_nails_enabled/rule.yml -index b4272654..41a8486d 100644 +index 83ef73b9..3ff9ea78 100644 --- a/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/service_nails_enabled/rule.yml +++ b/linux_os/guide/system/software/integrity/endpoint_security_software/mcafee_security_software/service_nails_enabled/rule.yml @@ -1,6 +1,6 @@ @@ -27945,14 +23970,14 @@ index b4272654..41a8486d 100644 title: 'Enable nails Service' diff --git a/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml -index d9a33629..fecd5b5b 100644 +index 9486031b..4b9cb42d 100644 --- a/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml +++ b/linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: "Enable Dracut FIPS Module" @@ -27976,45 +24001,45 @@ index 87476a7b..37673cc8 100644 fips-mode-setup --enable diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml -index 558dfc89..84ad511d 100644 +index 64b18ac6..5e43f05d 100644 --- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml +++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: Enable FIPS Mode -@@ -39,7 +39,7 @@ references: +@@ -40,7 +40,7 @@ references: + nist: SC-12(2),SC-12(3),IA-7,SC-13,CM-6(a),SC-12 ospp: FCS_COP.1(1),FCS_COP.1(2),FCS_COP.1(3),FCS_COP.1(4),FCS_CKM.1,FCS_CKM.2,FCS_TLSC_EXT.1 srg: SRG-OS-000478-GPOS-00223,SRG-OS-000396-GPOS-00176 - ism: "1446" - stigid@rhel8: RHEL-08-010020 + stigid@almalinux8: RHEL-08-010020 + vmmsrg: SRG-OS-000120-VMM-000600,SRG-OS-000478-VMM-001980,SRG-OS-000396-VMM-001590 ocil_clause: 'FIPS mode is not enabled' - diff --git a/linux_os/guide/system/software/integrity/fips/etc_system_fips_exists/rule.yml b/linux_os/guide/system/software/integrity/fips/etc_system_fips_exists/rule.yml -index 7b2076df..fae387a5 100644 +index 2ef6c50d..f1085e5b 100644 --- a/linux_os/guide/system/software/integrity/fips/etc_system_fips_exists/rule.yml +++ b/linux_os/guide/system/software/integrity/fips/etc_system_fips_exists/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: Ensure '/etc/system-fips' exists diff --git a/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/rule.yml -index 77c78d57..adcaf4b2 100644 +index 949132df..7f78ed4c 100644 --- a/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/rule.yml +++ b/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/rule.yml @@ -18,7 +18,7 @@ description: |- <li>On BIOS-based machines, issue the following command as <tt>root</tt>: - <pre>~]# grub2-mkconfig -o /boot/grub2/grub.cfg</pre></li> + <pre>~]# grub2-mkconfig -o {{{ grub2_boot_path }}}/grub.cfg</pre></li> <li>On UEFI-based machines, issue the following command as <tt>root</tt>: - <pre>~]# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg</pre></li> + <pre>~]# grub2-mkconfig -o /boot/efi/EFI/almalinux/grub.cfg</pre></li> @@ -28022,17 +24047,26 @@ index 77c78d57..adcaf4b2 100644 rationale: |- diff --git a/linux_os/guide/system/software/integrity/fips/sysctl_crypto_fips_enabled/rule.yml b/linux_os/guide/system/software/integrity/fips/sysctl_crypto_fips_enabled/rule.yml -index b439a030..0c1194cd 100644 +index 0fbca696..77a65f8e 100644 --- a/linux_os/guide/system/software/integrity/fips/sysctl_crypto_fips_enabled/rule.yml +++ b/linux_os/guide/system/software/integrity/fips/sysctl_crypto_fips_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol8,rhel8,rhv4 -+prodtype: fedora,rhcos4,ol8,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol8,rhcos4,rhel8,rhel9,rhv4 ++prodtype: fedora,ol8,rhcos4,rhel8,almalinux8,rhel9,rhv4 title: "Set kernel parameter 'crypto.fips_enabled' to 1" +@@ -31,7 +31,7 @@ references: + nerc-cip: CIP-003-3 R4.2,CIP-007-3 R5.1 + nist: SC-12(2),SC-12(3),IA-7,SC-13,CM-6(a),SC-12 + srg: SRG-OS-000033-GPOS-00014,SRG-OS-000125-GPOS-00065,SRG-OS-000396-GPOS-00176,SRG-OS-000423-GPOS-00187,SRG-OS-000478-GPOS-00223 +- stigid@rhel8: RHEL-08-010020 ++ stigid@almalinux8: RHEL-08-010020 + vmmsrg: SRG-OS-000120-VMM-000600,SRG-OS-000478-VMM-001980,SRG-OS-000396-VMM-001590 + + ocil_clause: 'crypto.fips_enabled is not 1' diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/bash/shared.sh index 7c25aebf..19796558 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/bash/shared.sh @@ -28043,6 +24077,92 @@ index 7c25aebf..19796558 100644 {{{ bash_package_install("aide") }}} +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/rule.yml +index e4a1668c..5a85573e 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/rule.yml ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_build_database/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 + + title: 'Build and Test AIDE Database' + +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml +index edef2721..7975ba73 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml +@@ -1,4 +1,4 @@ +-# platform = multi_platform_sle,multi_platform_rhel ++# platform = multi_platform_sle,multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh +index 0875eeec..a480f991 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/bash/shared.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_rhel ++# platform = multi_platform_rhel,multi_platform_almalinux + # reboot = false + # strategy = restrict + # complexity = low +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml +index 17a95bf4..2ee64ecc 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: sle12,sle15,ubuntu2004,rhel8,fedora ++prodtype: sle12,sle15,ubuntu2004,rhel8,almalinux8,fedora + + title: 'Configure AIDE to Verify the Audit Tools' + +@@ -39,7 +39,7 @@ references: + disa: CCI-001496 + nist: AU-9(3),AU-9(3).1 + srg: SRG-OS-000278-GPOS-00108 +- stigid@rhel8: RHEL-08-030650 ++ stigid@almalinux8: RHEL-08-030650 + stigid@sle12: SLES-12-010540 + stigid@sle15: SLES-15-030630 + stigid@ubuntu2004: UBTU-20-010205 +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh +index 756b88d8..000925aa 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora + + + yum -y install aide +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh +index f3a2a126..6d175e17 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/correct_with_selinux.pass.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora + + yum -y install aide + +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh +index 4315cef2..00ce6b2e 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/tests/not_config.fail.sh +@@ -1,5 +1,5 @@ + #!/bin/bash +-# platform = multi_platform_rhel,multi_platform_fedora ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora + + + yum -y install aide diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh index aa605c85..0d3ad729 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/bash/shared.sh @@ -28054,50 +24174,50 @@ index aa605c85..0d3ad729 100644 {{{ bash_package_install("aide") }}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml -index 59669052..ef1ef9f1 100644 +index e7991c7a..4e888b76 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_periodic_cron_checking/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004,wrlinux1019 title: 'Configure Periodic Execution of AIDE' -diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh -index fbe9ddbb..4d6d584a 100644 ---- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh -+++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/bash/shared.sh +diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml +index 5c11fc17..e4efb9ca 100644 +--- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml ++++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,Red Hat Virtualization 4,multi_platform_wrlinux,multi_platform_ol,multi_platform_sle +# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Virtualization 4,multi_platform_wrlinux,multi_platform_ol,multi_platform_sle - - {{{ bash_package_install("aide") }}} - + # reboot = false + # strategy = restrict + # complexity = low diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml -index 80a0bce1..e4b8f780 100644 +index 3d22d123..90372d96 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_scan_notification/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019,sle12 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019,sle12 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,wrlinux1019 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,wrlinux1019 title: 'Configure Notification of Post-AIDE Scan Details' -@@ -50,7 +50,7 @@ references: - stigid@sle12: SLES-12-010510 - srg@sle12: SRG-OS-000447-GPOS-00201 - disa@sle12: CCI-002702 +@@ -47,7 +47,7 @@ references: + srg: SRG-OS-000363-GPOS-00150,SRG-OS-000447-GPOS-00201 + stigid@ol7: OL07-00-020040 + stigid@rhel7: RHEL-07-020040 - stigid@rhel8: RHEL-08-010360 + stigid@almalinux8: RHEL-08-010360 + stigid@sle12: SLES-12-010510 ocil_clause: 'AIDE has not been configured or has not been configured to notify personnel of scan details' - diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh -index 3e829abf..96f5141d 100644 +index 34a11452..b22a658d 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/bash/shared.sh @@ -1,4 +1,4 @@ @@ -28107,14 +24227,14 @@ index 3e829abf..96f5141d 100644 {{{ bash_package_install("aide") }}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/rule.yml -index 1f86ed8a..8db7207e 100644 +index 51d6752a..d53ad860 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Configure AIDE to Use FIPS 140-2 for Validating Hashes' @@ -28143,35 +24263,35 @@ index 3c203720..8211c4ad 100644 cat >/etc/aide.conf <<EOL diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/bash/shared.sh -index 1de7a6f8..6ff367fe 100644 +index bcf29f05..71ee850e 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle {{{ bash_package_install("aide") }}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/rule.yml -index 451ad976..170fb137 100644 +index d37006d5..890a7c00 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15 title: 'Configure AIDE to Verify Access Control Lists (ACLs)' -@@ -36,7 +36,7 @@ references: - cobit5: APO01.06,BAI03.05,BAI06.01,DSS06.02 - iso27001-2013: A.11.2.4,A.12.2.1,A.12.5.1,A.14.1.2,A.14.1.3,A.14.2.4 - cis-csc: 2,3 +@@ -42,7 +42,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021600 + stigid@rhel7: RHEL-07-021600 - stigid@rhel8: RHEL-08-040310 + stigid@almalinux8: RHEL-08-040310 - - ocil_clause: 'the acl option is missing or not added to the correct ruleset' + stigid@sle12: SLES-12-010520 + stigid@sle15: SLES-15-040040 diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_acls/tests/correct_value.pass.sh index 9f9f96e4..e654ec2e 100644 @@ -28198,35 +24318,35 @@ index fd664d46..a00afa56 100644 cat >/etc/aide.conf <<EOL diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/bash/shared.sh -index 1bce723a..494f0902 100644 +index ab7ad7ab..f3fb9b53 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol -+# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol +-# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_ol,multi_platform_sle ++# platform = Red Hat Virtualization 4,multi_platform_fedora,multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_sle {{{ bash_package_install("aide") }}} diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/rule.yml -index 3be8209a..b553a3df 100644 +index c5f88cdf..537a1531 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15 title: 'Configure AIDE to Verify Extended Attributes' -@@ -36,7 +36,7 @@ references: - cobit5: APO01.06,BAI03.05,BAI06.01,DSS06.02 - iso27001-2013: A.11.2.4,A.12.2.1,A.12.5.1,A.14.1.2,A.14.1.3,A.14.2.4 - cis-csc: 2,3 +@@ -42,7 +42,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-021610 + stigid@rhel7: RHEL-07-021610 - stigid@rhel8: RHEL-08-040300 + stigid@almalinux8: RHEL-08-040300 - - ocil_clause: 'the xattrs option is missing or not added to the correct ruleset' + stigid@sle12: SLES-12-010530 + stigid@sle15: SLES-15-040050 diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/tests/correct_value.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/aide/aide_verify_ext_attributes/tests/correct_value.pass.sh index 9f9f96e4..e654ec2e 100644 @@ -28253,19 +24373,28 @@ index d02d969a..a88b92ab 100644 cat >/etc/aide.conf <<EOL diff --git a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml -index abf13a27..254e8814 100644 +index 51adb671..59936f70 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/aide/package_aide_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,wrlinux1019 +-prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 ++prodtype: debian10,debian9,fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004,wrlinux1019 title: 'Install AIDE' +@@ -36,7 +36,7 @@ references: + nist-csf: DE.CM-1,DE.CM-7,PR.DS-1,PR.DS-6,PR.DS-8,PR.IP-1,PR.IP-3 + pcidss: Req-11.5 + srg: SRG-OS-000363-GPOS-00150 +- stigid@rhel8: RHEL-08-010360 ++ stigid@almalinux8: RHEL-08-010360 + stigid@sle12: SLES-12-010500 + stigid@sle15: SLES-15-010420 + stigid@ubuntu2004: UBTU-20-010450 diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml -index 561ad620..1b8f6024 100644 +index 561ad620..5fb03100 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/ansible/shared.yml @@ -1,5 +1,5 @@ @@ -28275,6 +24404,15 @@ index 561ad620..1b8f6024 100644 # reboot = false # strategy = restrict # complexity = high +@@ -12,7 +12,7 @@ + - name: "Set fact: Package manager reinstall command (yum)" + set_fact: + package_manager_reinstall_cmd: yum reinstall -y +- when: (ansible_distribution == "RedHat" or ansible_distribution == "OracleLinux") ++ when: (ansible_distribution == "RedHat" or ansible_distribution == "OracleLinux" or ansible_distribution == "AlmaLinux") + + - name: "Read files with incorrect hash" + command: rpm -Va --nodeps --nosize --nomtime --nordev --nocaps --nolinkto --nouser --nogroup --nomode --noghost --noconfig diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/bash/shared.sh b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/bash/shared.sh index b98aca62..5f85cf14 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/bash/shared.sh @@ -28286,14 +24424,14 @@ index b98aca62..5f85cf14 100644 # Find which files have incorrect hash (not in /etc, because of the system related config files) and then get files names files_with_incorrect_hash="$(rpm -Va --noconfig | grep -E '^..5' | awk '{print $NF}' )" diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/rule.yml -index b0a2d007..db1f41b4 100644 +index 1e13e3f0..fd758735 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_hashes/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Verify File Hashes with RPM' @@ -28318,14 +24456,14 @@ index 329a00f5..d3cce1c0 100644 # strategy = restrict # complexity = high diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml -index d4f76c4e..28587bd5 100644 +index 909ddd30..613f004b 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15 ++prodtype: ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15 title: 'Verify and Correct Ownership with RPM' @@ -28350,51 +24488,38 @@ index 03cbc397..3a0fff79 100644 # strategy = restrict # complexity = high diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml -index 87a4934c..42df0116 100644 +index 60ec3412..0c2e2728 100644 --- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml +++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_permissions/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15,wrlinux1019 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,wrlinux1019 title: 'Verify and Correct File Permissions with RPM' -diff --git a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml b/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml -index 51b839b5..390de3bb 100644 ---- a/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml -+++ b/linux_os/guide/system/software/sap_host/accounts_authorized_local_users/rule.yml -@@ -26,7 +26,7 @@ rationale: |- - severity: medium - - references: -- stigid@rhel8: RHEL-08-020320 -+ stigid@almalinux8: RHEL-08-020320 - - ocil_clause: 'there are unauthorized local user accounts on the system' - diff --git a/linux_os/guide/system/software/sudo/package_sudo_installed/rule.yml b/linux_os/guide/system/software/sudo/package_sudo_installed/rule.yml -index 4b78278e..2a23ce62 100644 +index 1d201061..c47dadee 100644 --- a/linux_os/guide/system/software/sudo/package_sudo_installed/rule.yml +++ b/linux_os/guide/system/software/sudo/package_sudo_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,rhv4,sle15 -+prodtype: fedora,rhcos4,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle15 +-prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,rhel9,rhv4,sle15,ubuntu2004 ++prodtype: fedora,ol7,ol8,rhcos4,rhel7,rhel8,almalinux8,rhel9,rhv4,sle15,ubuntu2004 title: 'Install sudo Package' diff --git a/linux_os/guide/system/software/sudo/sudo_add_env_reset/rule.yml b/linux_os/guide/system/software/sudo/sudo_add_env_reset/rule.yml -index 477a3309..d2d63174 100644 +index d12760b9..f688024f 100644 --- a/linux_os/guide/system/software/sudo/sudo_add_env_reset/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_add_env_reset/rule.yml @@ -1,13 +1,13 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8 title: 'Ensure sudo Runs In A Minimal Environment - sudo env_reset' @@ -28407,14 +24532,14 @@ index 477a3309..d2d63174 100644 {{%- endif %}} This should be enabled by making sure that the <tt>env_reset</tt> tag exists in diff --git a/linux_os/guide/system/software/sudo/sudo_add_ignore_dot/rule.yml b/linux_os/guide/system/software/sudo/sudo_add_ignore_dot/rule.yml -index 2b4fd4be..74bf46f7 100644 +index f26a63e7..622055f3 100644 --- a/linux_os/guide/system/software/sudo/sudo_add_ignore_dot/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_add_ignore_dot/rule.yml @@ -1,13 +1,13 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8 title: 'Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot' @@ -28426,15 +24551,27 @@ index 2b4fd4be..74bf46f7 100644 On {{{ full_name }}}, <tt>env_reset</tt> is enabled by default {{%- endif %}} This should be enabled by making sure that the <tt>ignore_dot</tt> tag exists in +diff --git a/linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml b/linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml +index ae339952..40ef5a07 100644 +--- a/linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml ++++ b/linux_os/guide/system/software/sudo/sudo_add_passwd_timeout/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true + +-prodtype: ol7,ol8,rhel7,rhel8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8 + + title: 'Ensure sudo passwd_timeout is appropriate - sudo passwd_timeout' + diff --git a/linux_os/guide/system/software/sudo/sudo_add_umask/rule.yml b/linux_os/guide/system/software/sudo/sudo_add_umask/rule.yml -index d2100dd0..0544d745 100644 +index 189c1b9d..3f3730f4 100644 --- a/linux_os/guide/system/software/sudo/sudo_add_umask/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_add_umask/rule.yml @@ -1,13 +1,13 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8 title: 'Ensure sudo umask is appropriate - sudo umask' @@ -28502,14 +24639,14 @@ index a812074a..e66bdc71 100644 echo "Defaults use_pty,umask=0027,noexec" >> /etc/sudoers diff --git a/linux_os/guide/system/software/sudo/sudo_dedicated_group/rule.yml b/linux_os/guide/system/software/sudo/sudo_dedicated_group/rule.yml -index 770b7144..b1b86f8c 100644 +index b3f766f8..80c783ff 100644 --- a/linux_os/guide/system/software/sudo/sudo_dedicated_group/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_dedicated_group/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8 -+prodtype: rhel7,rhel8,almalinux8 +-prodtype: ol7,ol8,rhel7,rhel8 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8 title: 'Ensure a dedicated group owns sudo' @@ -28524,33 +24661,54 @@ index 1c87c96c..265432ee 100644 # Make sure sudo is owned by root group diff --git a/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml b/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml -index d01fa446..3ebe8975 100644 +index bb1d3bd4..0d06c1c7 100644 --- a/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml @@ -37,7 +37,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 + srg: SRG-OS-000373-GPOS-00156,SRG-OS-000373-GPOS-00157,SRG-OS-000373-GPOS-00158 + stigid@ol7: OL07-00-010350 + stigid@rhel7: RHEL-07-010350 - stigid@rhel8: RHEL-08-010381 + stigid@almalinux8: RHEL-08-010381 - - ocil_clause: "!authenticate is enabled in sudo" - + stigid@sle12: SLES-12-010110 + stigid@sle15: SLES-15-010450 + vsrg: SRG-OS-000373-VMM-001470,SRG-OS-000373-VMM-001480,SRG-OS-000373-VMM-001490 diff --git a/linux_os/guide/system/software/sudo/sudo_remove_nopasswd/rule.yml b/linux_os/guide/system/software/sudo/sudo_remove_nopasswd/rule.yml -index 382c4b88..b0aace1c 100644 +index 84c21869..b9032533 100644 --- a/linux_os/guide/system/software/sudo/sudo_remove_nopasswd/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_remove_nopasswd/rule.yml @@ -38,7 +38,7 @@ references: - cobit5: DSS05.04,DSS05.10,DSS06.03,DSS06.10 - iso27001-2013: A.18.1.4,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3 - cis-csc: 1,12,15,16,5 + srg: SRG-OS-000373-GPOS-00156,SRG-OS-000373-GPOS-00157,SRG-OS-000373-GPOS-00158 + stigid@ol7: OL07-00-010340 + stigid@rhel7: RHEL-07-010340 - stigid@rhel8: RHEL-08-010380 + stigid@almalinux8: RHEL-08-010380 + stigid@sle12: SLES-12-010110 + stigid@sle15: SLES-15-010450 + vsrg: SRG-OS-000373-VMM-001470,SRG-OS-000373-VMM-001480,SRG-OS-000373-VMM-001490 +diff --git a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml +index 8622d6af..db291979 100644 +--- a/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml ++++ b/linux_os/guide/system/software/sudo/sudo_require_reauthentication/rule.yml +@@ -1,6 +1,6 @@ + documentation_complete: true - ocil_clause: 'nopasswd is enabled in sudo' +-prodtype: rhel8,sle12,sle15 ++prodtype: rhel8,almalinux8,sle12,sle15 + + title: 'The operating system must require Re-Authentication when using the sudo command. + Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout' +@@ -33,7 +33,7 @@ references: + disa: CCI-002038 + nist: IA-11 + srg: SRG-OS-000373-GPOS-00156 +- stigid@rhel8: RHEL-08-010384 ++ stigid@almalinux8: RHEL-08-010384 + stigid@sle12: SLES-12-010113 + stigid@sle15: SLES-15-020102 diff --git a/linux_os/guide/system/software/sudo/sudo_restrict_others_executable_permission/rule.yml b/linux_os/guide/system/software/sudo/sudo_restrict_others_executable_permission/rule.yml -index 4452e893..2dd446ce 100644 +index 174da919..ee73e10e 100644 --- a/linux_os/guide/system/software/sudo/sudo_restrict_others_executable_permission/rule.yml +++ b/linux_os/guide/system/software/sudo/sudo_restrict_others_executable_permission/rule.yml @@ -1,6 +1,6 @@ @@ -28561,90 +24719,247 @@ index 4452e893..2dd446ce 100644 title: 'Ensure only owner and members of group owner of /usr/bin/sudo can execute it' +diff --git a/linux_os/guide/system/software/sudo/sudo_restrict_privilege_elevation_to_authorized/rule.yml b/linux_os/guide/system/software/sudo/sudo_restrict_privilege_elevation_to_authorized/rule.yml +index a9a23baf..9304e425 100644 +--- a/linux_os/guide/system/software/sudo/sudo_restrict_privilege_elevation_to_authorized/rule.yml ++++ b/linux_os/guide/system/software/sudo/sudo_restrict_privilege_elevation_to_authorized/rule.yml +@@ -2,7 +2,7 @@ documentation_complete: true + + title: 'The operating system must restrict privilege elevation to authorized personnel' + +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15 + + description: |- + The sudo command allows a user to execute programs with elevated +@@ -33,7 +33,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-010341 + stigid@rhel7: RHEL-07-010341 +- stigid@rhel8: RHEL-08-010382 ++ stigid@almalinux8: RHEL-08-010382 + stigid@sle12: SLES-12-010111 + stigid@sle15: SLES-15-020101 + +diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml +index 2ce70f49..311a10d1 100644 +--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml ++++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/rule.yml +@@ -2,7 +2,7 @@ documentation_complete: true + + title: 'Ensure invoking users password for privilege escalation when using sudo' + +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,sle12,sle15 + + description: |- + The sudoers security policy requires that users authenticate themselves before they can use sudo. +@@ -32,7 +32,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-010342 + stigid@rhel7: RHEL-07-010342 +- stigid@rhel8: RHEL-08-010383 ++ stigid@almalinux8: RHEL-08-010383 + stigid@sle12: SLES-12-010112 + stigid@sle15: SLES-15-020103 + +diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh +index 9706b8bd..c543b1b3 100644 +--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh ++++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.fail.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15 ++# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,SUSE Linux Enterprise 15 + # packages = sudo + + if [ $(sudo egrep -i '(!rootpw|!targetpw|!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ] +diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh +index 093f9dd8..0cd6dbf4 100644 +--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh ++++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_passwd.pass.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15 ++# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,SUSE Linux Enterprise 15 + # packages = sudo + + echo 'Defaults !targetpw' >> /etc/sudoers +diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh +index b12d1f88..eebf2cd7 100644 +--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh ++++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_rootpw.fail.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15 ++# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,SUSE Linux Enterprise 15 + # packages = sudo + + if [ $(sudo egrep -i '(!rootpw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ] +diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh +index 93b3dfeb..5b180d91 100644 +--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh ++++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_runaspw.fail.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15 ++# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,SUSE Linux Enterprise 15 + # packages = sudo + + if [ $(sudo egrep -i '(!runaspw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ] +diff --git a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh +index 103cb466..e23bcce4 100644 +--- a/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh ++++ b/linux_os/guide/system/software/sudo/sudoers_validate_passwd/tests/sudoers_validate_targetpw.fail.sh +@@ -1,4 +1,4 @@ +-# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,SUSE Linux Enterprise 15 ++# platform = multi_platform_fedora,multi_platform_ol,multi_platform_rhel,multi_platform_almalinux,SUSE Linux Enterprise 15 + # packages = sudo + + if [ $(sudo egrep -i '(!targetpw)' /etc/sudoers /etc/sudoers.d/* | grep -v '#' | wc -l) -ne 0 ] diff --git a/linux_os/guide/system/software/system-tools/package_abrt-addon-ccpp_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_abrt-addon-ccpp_removed/rule.yml -index ed2fc64d..e1994145 100644 +index f77d3bff..b0859cdf 100644 --- a/linux_os/guide/system/software/system-tools/package_abrt-addon-ccpp_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_abrt-addon-ccpp_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall abrt-addon-ccpp Package' +@@ -21,7 +21,7 @@ identifiers: + references: + disa: CCI-000381 + srg: SRG-OS-000095-GPOS-00049 +- stigid@rhel8: RHEL-08-040001 ++ stigid@almalinux8: RHEL-08-040001 + + {{{ complete_ocil_entry_package(package="abrt-addon-ccpp") }}} + diff --git a/linux_os/guide/system/software/system-tools/package_abrt-addon-kerneloops_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_abrt-addon-kerneloops_removed/rule.yml -index 8bbf9ea5..061a6e6f 100644 +index 6e7b5d51..dd6157c4 100644 --- a/linux_os/guide/system/software/system-tools/package_abrt-addon-kerneloops_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_abrt-addon-kerneloops_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall abrt-addon-kerneloops Package' +@@ -21,7 +21,7 @@ identifiers: + references: + disa: CCI-000381 + srg: SRG-OS-000095-GPOS-00049 +- stigid@rhel8: RHEL-08-040001 ++ stigid@almalinux8: RHEL-08-040001 + + {{{ complete_ocil_entry_package(package="abrt-addon-kerneloops") }}} + diff --git a/linux_os/guide/system/software/system-tools/package_abrt-addon-python_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_abrt-addon-python_removed/rule.yml -index 9be8b08b..4a87ccc7 100644 +index ceacda79..24990e5d 100644 --- a/linux_os/guide/system/software/system-tools/package_abrt-addon-python_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_abrt-addon-python_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall abrt-addon-python Package' +@@ -21,7 +21,7 @@ identifiers: + references: + disa: CCI-000381 + srg: SRG-OS-000095-GPOS-00049 +- stigid@rhel8: RHEL-08-040001 ++ stigid@almalinux8: RHEL-08-040001 + + {{{ complete_ocil_entry_package(package="abrt-addon-python") }}} + diff --git a/linux_os/guide/system/software/system-tools/package_abrt-cli_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_abrt-cli_removed/rule.yml -index 9aa7f11a..e3ec3182 100644 +index 51b2541d..3a20fb80 100644 --- a/linux_os/guide/system/software/system-tools/package_abrt-cli_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_abrt-cli_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall abrt-cli Package' +@@ -21,7 +21,7 @@ identifiers: + references: + disa: CCI-000381 + srg: SRG-OS-000095-GPOS-00049 +- stigid@rhel8: RHEL-08-040001 ++ stigid@almalinux8: RHEL-08-040001 + + {{{ complete_ocil_entry_package(package="abrt-cli") }}} + diff --git a/linux_os/guide/system/software/system-tools/package_abrt-plugin-logger_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_abrt-plugin-logger_removed/rule.yml -index d970def6..917b5c60 100644 +index d5ee870a..723b0714 100644 --- a/linux_os/guide/system/software/system-tools/package_abrt-plugin-logger_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_abrt-plugin-logger_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall abrt-plugin-logger Package' +@@ -21,7 +21,7 @@ identifiers: + references: + disa: CCI-000381 + srg: SRG-OS-000095-GPOS-00049 +- stigid@rhel8: RHEL-08-040001 ++ stigid@almalinux8: RHEL-08-040001 + + {{{ complete_ocil_entry_package(package="abrt-plugin-logger") }}} + diff --git a/linux_os/guide/system/software/system-tools/package_abrt-plugin-rhtsupport_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_abrt-plugin-rhtsupport_removed/rule.yml -index 7f7787a1..50d68b52 100644 +index ba9d22d6..b635c8ce 100644 --- a/linux_os/guide/system/software/system-tools/package_abrt-plugin-rhtsupport_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_abrt-plugin-rhtsupport_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall abrt-plugin-rhtsupport Package' +@@ -21,7 +21,7 @@ identifiers: + references: + disa: CCI-000381 + srg: SRG-OS-000095-GPOS-00049 +- stigid@rhel8: RHEL-08-040001 ++ stigid@almalinux8: RHEL-08-040001 + + {{{ complete_ocil_entry_package(package="abrt-plugin-rhtsupport") }}} + diff --git a/linux_os/guide/system/software/system-tools/package_abrt-plugin-sosreport_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_abrt-plugin-sosreport_removed/rule.yml -index 6107659d..1f1ae375 100644 +index 484fb9a7..3f140aeb 100644 --- a/linux_os/guide/system/software/system-tools/package_abrt-plugin-sosreport_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_abrt-plugin-sosreport_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall abrt-plugin-sosreport Package' +@@ -20,7 +20,7 @@ identifiers: + references: + disa: CCI-000381 + srg: SRG-OS-000095-GPOS-00049 +- stigid@rhel8: RHEL-08-040001 ++ stigid@almalinux8: RHEL-08-040001 + + {{{ complete_ocil_entry_package(package="abrt-plugin-sosreport") }}} + diff --git a/linux_os/guide/system/software/system-tools/package_binutils_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_binutils_installed/rule.yml index ec4f690a..c432c0cb 100644 --- a/linux_os/guide/system/software/system-tools/package_binutils_installed/rule.yml @@ -28658,7 +24973,7 @@ index ec4f690a..c432c0cb 100644 title: 'Install binutils Package' diff --git a/linux_os/guide/system/software/system-tools/package_dnf-plugin-subscription-manager_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_dnf-plugin-subscription-manager_installed/rule.yml -index 904ef627..8e934bf9 100644 +index 8b657722..42471018 100644 --- a/linux_os/guide/system/software/system-tools/package_dnf-plugin-subscription-manager_installed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_dnf-plugin-subscription-manager_installed/rule.yml @@ -1,6 +1,6 @@ @@ -28670,86 +24985,86 @@ index 904ef627..8e934bf9 100644 title: 'Install dnf-plugin-subscription-manager Package' diff --git a/linux_os/guide/system/software/system-tools/package_geolite2-city_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_geolite2-city_removed/rule.yml -index eef5d88b..03800f9a 100644 +index e9863fa8..dbe2a912 100644 --- a/linux_os/guide/system/software/system-tools/package_geolite2-city_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_geolite2-city_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall geolite2-city Package' diff --git a/linux_os/guide/system/software/system-tools/package_geolite2-country_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_geolite2-country_removed/rule.yml -index 8022a4b1..da9c56cd 100644 +index 1210a1e8..58d95cc6 100644 --- a/linux_os/guide/system/software/system-tools/package_geolite2-country_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_geolite2-country_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall geolite2-country Package' diff --git a/linux_os/guide/system/software/system-tools/package_gssproxy_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_gssproxy_removed/rule.yml -index fa94959f..b5c5271e 100644 +index 43a60100..62ed0519 100644 --- a/linux_os/guide/system/software/system-tools/package_gssproxy_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_gssproxy_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall gssproxy Package' -@@ -18,7 +18,7 @@ identifiers: - +@@ -20,7 +20,7 @@ identifiers: references: - srg: SRG-OS-000095-GPOS-00049 + disa: CCI-000381,CCI-000366 + srg: SRG-OS-000095-GPOS-00049,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040370 + stigid@almalinux8: RHEL-08-040370 {{{ complete_ocil_entry_package(package="gssproxy") }}} diff --git a/linux_os/guide/system/software/system-tools/package_iprutils_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_iprutils_removed/rule.yml -index 9ec5c88c..f877d5db 100644 +index fe76c57b..6f6971a4 100644 --- a/linux_os/guide/system/software/system-tools/package_iprutils_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_iprutils_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall iprutils Package' -@@ -19,7 +19,7 @@ identifiers: - +@@ -21,7 +21,7 @@ identifiers: references: - srg: SRG-OS-000095-GPOS-00049 + disa: CCI-000366 + srg: SRG-OS-000095-GPOS-00049,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040380 + stigid@almalinux8: RHEL-08-040380 {{{ complete_ocil_entry_package(package="iprutils") }}} diff --git a/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml -index 9753c2c7..822dedc7 100644 +index 0e030e15..79bdf11b 100644 --- a/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_krb5-workstation_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall krb5-workstation Package' -@@ -22,7 +22,7 @@ identifiers: - +@@ -24,7 +24,7 @@ identifiers: references: + disa: CCI-000803 srg: SRG-OS-000095-GPOS-00049,SRG-OS-000120-GPOS-00061 - stigid@rhel8: RHEL-08-010162 + stigid@almalinux8: RHEL-08-010162 @@ -28769,14 +25084,14 @@ index 6696d589..a0122c7c 100644 title: 'Install libcap-ng-utils Package' diff --git a/linux_os/guide/system/software/system-tools/package_openscap-scanner_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_openscap-scanner_installed/rule.yml -index a600b42f..886b9e7b 100644 +index c2c8a19a..28ab5955 100644 --- a/linux_os/guide/system/software/system-tools/package_openscap-scanner_installed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_openscap-scanner_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install openscap-scanner Package' @@ -28793,50 +25108,59 @@ index 80a273bf..74169dbe 100644 title: 'Uninstall pigz Package' diff --git a/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml -index 375301fd..875d9c00 100644 +index 2396f5bb..56da7af6 100644 --- a/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_rear_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Install rear Package' diff --git a/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml -index 4ab170b4..001f4058 100644 +index 663a2706..319ef34c 100644 --- a/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_rng-tools_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install rng-tools Package' +@@ -21,7 +21,7 @@ identifiers: + references: + disa: CCI-000366 + srg: SRG-OS-000480-GPOS-00227 +- stigid@rhel8: RHEL-08-010472 ++ stigid@almalinux8: RHEL-08-010472 + + ocil_clause: 'the package is not installed' + diff --git a/linux_os/guide/system/software/system-tools/package_scap-security-guide_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_scap-security-guide_installed/rule.yml -index 94bf947d..6adc1ab0 100644 +index a7f9dfd8..d5d24a55 100644 --- a/linux_os/guide/system/software/system-tools/package_scap-security-guide_installed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_scap-security-guide_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install scap-security-guide Package' diff --git a/linux_os/guide/system/software/system-tools/package_subscription-manager_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_subscription-manager_installed/rule.yml -index 59a04407..9e96523d 100644 +index b90a7588..5e93b020 100644 --- a/linux_os/guide/system/software/system-tools/package_subscription-manager_installed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_subscription-manager_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: rhel7,rhel8,rhv4 -+prodtype: rhel7,rhel8,almalinux8,rhv4 +-prodtype: rhel7,rhel8,rhel9,rhv4 ++prodtype: rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Install subscription-manager Package' @@ -28853,28 +25177,28 @@ index e5b9a440..e3c2435f 100644 title: 'Install tar Package' diff --git a/linux_os/guide/system/software/system-tools/package_tuned_removed/rule.yml b/linux_os/guide/system/software/system-tools/package_tuned_removed/rule.yml -index f12bbc20..090e5bf4 100644 +index 9f5f17ec..9c5c9725 100644 --- a/linux_os/guide/system/software/system-tools/package_tuned_removed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_tuned_removed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9 title: 'Uninstall tuned Package' -@@ -21,7 +21,7 @@ identifiers: - +@@ -23,7 +23,7 @@ identifiers: references: - srg: SRG-OS-000095-GPOS-00049 + disa: CCI-000366 + srg: SRG-OS-000095-GPOS-00049,SRG-OS-000480-GPOS-00227 - stigid@rhel8: RHEL-08-040390 + stigid@almalinux8: RHEL-08-040390 {{{ complete_ocil_entry_package(package="tuned") }}} diff --git a/linux_os/guide/system/software/system-tools/package_vim_installed/rule.yml b/linux_os/guide/system/software/system-tools/package_vim_installed/rule.yml -index f67605de..3949e06c 100644 +index 0eb7a8dd..34344f55 100644 --- a/linux_os/guide/system/software/system-tools/package_vim_installed/rule.yml +++ b/linux_os/guide/system/software/system-tools/package_vim_installed/rule.yml @@ -1,6 +1,6 @@ @@ -28896,36 +25220,36 @@ index caaeb5cd..b1f397c0 100644 # strategy = restrict # complexity = low diff --git a/linux_os/guide/system/software/updating/clean_components_post_updating/bash/shared.sh b/linux_os/guide/system/software/updating/clean_components_post_updating/bash/shared.sh -index ab8b8c47..129e923f 100644 +index 929ef50c..d2207f47 100644 --- a/linux_os/guide/system/software/updating/clean_components_post_updating/bash/shared.sh +++ b/linux_os/guide/system/software/updating/clean_components_post_updating/bash/shared.sh @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_rhv if grep --silent ^clean_requirements_on_remove /etc/yum.conf ; then sed -i "s/^clean_requirements_on_remove.*/clean_requirements_on_remove=1/g" /etc/yum.conf diff --git a/linux_os/guide/system/software/updating/clean_components_post_updating/rule.yml b/linux_os/guide/system/software/updating/clean_components_post_updating/rule.yml -index 6239e950..ab58e0f1 100644 +index b443bf0c..c15520fa 100644 --- a/linux_os/guide/system/software/updating/clean_components_post_updating/rule.yml +++ b/linux_os/guide/system/software/updating/clean_components_post_updating/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu2004 ++prodtype: ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu2004 title: 'Ensure {{{ pkg_manager }}} Removes Previous Package Versions' -@@ -33,7 +33,7 @@ references: - cobit5: APO12.01,APO12.02,APO12.03,APO12.04,BAI03.10,DSS05.01,DSS05.02 - iso27001-2013: A.12.6.1,A.14.2.3,A.16.1.3,A.18.2.2,A.18.2.3 - cis-csc: 18,20,4 +@@ -46,7 +46,7 @@ references: + srg: SRG-OS-000437-GPOS-00194 + stigid@ol7: OL07-00-020200 + stigid@rhel7: RHEL-07-020200 - stigid@rhel8: RHEL-08-010440 + stigid@almalinux8: RHEL-08-010440 - - ocil_clause: 'clean_requirements_on_remove is not enabled or configured correctly' - + stigid@sle12: SLES-12-010570 + stigid@sle15: SLES-15-010560 + stigid@ubuntu2004: UBTU-20-010449 diff --git a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/ansible/shared.yml b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/ansible/shared.yml index 779189d9..209aee84 100644 --- a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/ansible/shared.yml @@ -28936,25 +25260,15 @@ index 779189d9..209aee84 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/bash/shared.sh b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/bash/shared.sh -index 06bdd85e..100baa52 100644 ---- a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/bash/shared.sh -+++ b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 - - CONF="/etc/dnf/automatic.conf" - APPLY_UPDATES_REGEX="[[:space:]]*\[commands]([^\n\[]*\n+)+?[[:space:]]*apply_updates" diff --git a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml -index fd53efc5..c532e608 100644 +index 5467302f..b55188aa 100644 --- a/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml +++ b/linux_os/guide/system/software/updating/dnf-automatic_apply_updates/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8 -+prodtype: fedora,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 title: Configure dnf-automatic to Install Available Updates Automatically @@ -28968,28 +25282,63 @@ index ecf8379a..dab9e3f4 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/bash/shared.sh b/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/bash/shared.sh -index 7409103c..20027db3 100644 ---- a/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/bash/shared.sh -+++ b/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,Oracle Linux 8 -+# platform = multi_platform_fedora,Red Hat Enterprise Linux 8,AlmaLinux 8,Oracle Linux 8 - - CONF="/etc/dnf/automatic.conf" - APPLY_UPDATES_REGEX="[[:space:]]*\[commands]([^\n\[]*\n+)+?[[:space:]]*upgrade_type" diff --git a/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/rule.yml b/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/rule.yml -index 1a61232b..a8d4486f 100644 +index 351c9d43..6797fd60 100644 --- a/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/rule.yml +++ b/linux_os/guide/system/software/updating/dnf-automatic_security_updates_only/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8 -+prodtype: fedora,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 title: Configure dnf-automatic to Install Only Security Updates +diff --git a/linux_os/guide/system/software/updating/ensure_almalinux_gpgkey_installed/ansible/shared.yml b/linux_os/guide/system/software/updating/ensure_almalinux_gpgkey_installed/ansible/shared.yml +new file mode 100644 +index 00000000..7912da04 +--- /dev/null ++++ b/linux_os/guide/system/software/updating/ensure_almalinux_gpgkey_installed/ansible/shared.yml +@@ -0,0 +1,39 @@ ++# platform=multi_platform_almalinux ++# reboot = false ++# strategy = restrict ++# complexity = medium ++# disruption = medium ++- name: "Read permission of GPG key directory" ++ stat: ++ path: /etc/pki/rpm-gpg/ ++ register: gpg_key_directory_permission ++ check_mode: no ++ ++# It should fail if it doesn't find any fingerprints in file - maybe file was not parsed well. ++ ++- name: Read signatures in GPG key ++ # According to /usr/share/doc/gnupg2/DETAILS fingerprints are in "fpr" record in field 10 ++ command: gpg --show-keys --with-fingerprint --with-colons "/etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux" ++ args: ++ warn: False ++ changed_when: False ++ register: gpg_fingerprints ++ check_mode: no ++ ++- name: Set Fact - Installed GPG Fingerprints ++ set_fact: ++ gpg_installed_fingerprints: "{{ gpg_fingerprints.stdout | regex_findall('^pub.*\n(?:^fpr[:]*)([0-9A-Fa-f]*)', '\\1') | list }}" ++ ++- name: Set Fact - Valid fingerprints ++ set_fact: ++ gpg_valid_fingerprints: ("{{{ release_key_fingerprint }}}" "{{{ auxiliary_key_fingerprint }}}") ++ ++- name: Import AlmaLinux GPG key ++ rpm_key: ++ state: present ++ key: /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux ++ when: ++ - gpg_key_directory_permission.stat.mode <= '0755' ++ - (gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0 ++ - gpg_installed_fingerprints | length > 0 ++ - ansible_distribution == "AlmaLinux" diff --git a/linux_os/guide/system/software/updating/ensure_almalinux_gpgkey_installed/bash/shared.sh b/linux_os/guide/system/software/updating/ensure_almalinux_gpgkey_installed/bash/shared.sh new file mode 100644 index 00000000..dee95716 @@ -29123,7 +25472,7 @@ index 00000000..3e4fe227 + The command should return the string below: + <pre>gpg(AlmaLinux <packager@almalinux.org></pre> diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/shared.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/shared.yml -index 24be33be..2b784021 100644 +index 24be33be..bd3c35ea 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/shared.yml +++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -29132,6 +25481,15 @@ index 24be33be..2b784021 100644 # reboot = false # strategy = unknown # complexity = low +@@ -20,7 +20,7 @@ + value: 1 + no_extra_spaces: yes + create: False +- when: (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution == "Scientific" or yum_config_file.stat.exists) ++ when: (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution == "Scientific" or ansible_distribution == "AlmaLinux" or yum_config_file.stat.exists) + + - name: Ensure GPG check is globally activated (dnf) + ini_file: diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/bash/shared.sh b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/bash/shared.sh index 4469a468..80996789 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/bash/shared.sh @@ -29143,28 +25501,28 @@ index 4469a468..80996789 100644 replace_or_append "{{{ pkg_manager_config_file }}}" '^gpgcheck' '1' '@CCENUM@' diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml -index 7d031c93..fedafce3 100644 +index 8bf083bb..b2359634 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml +++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_globally_activated/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15 title: 'Ensure gpgcheck Enabled In Main {{{ pkg_manager }}} Configuration' -@@ -56,7 +56,7 @@ references: - cis-csc: 11,2,3,9 - anssi: BP28(R15) - stigid@sle12: SLES-12-010550 +@@ -57,7 +57,7 @@ references: + srg: SRG-OS-000366-GPOS-00153 + stigid@ol7: OL07-00-020050 + stigid@rhel7: RHEL-07-020050 - stigid@rhel8: RHEL-08-010370 + stigid@almalinux8: RHEL-08-010370 - - ocil_clause: 'GPG checking is not enabled' - + stigid@sle12: SLES-12-010550 + stigid@sle15: SLES-15-010430 + vmmsrg: SRG-OS-000366-VMM-001430,SRG-OS-000370-VMM-001460,SRG-OS-000404-VMM-001650 diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/ansible/shared.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/ansible/shared.yml -index 68553a12..de4ed0e1 100644 +index 68553a12..c9cdb166 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/ansible/shared.yml +++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -29173,39 +25531,38 @@ index 68553a12..de4ed0e1 100644 # reboot = false # strategy = unknown # complexity = low -diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/bash/shared.sh b/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/bash/shared.sh -index f012bc5c..4911ee96 100644 ---- a/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/bash/shared.sh -+++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/bash/shared.sh -@@ -1,4 +1,4 @@ --# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = multi_platform_wrlinux,Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv - . /usr/share/scap-security-guide/remediation_functions +@@ -19,7 +19,7 @@ + option: localpkg_gpgcheck + value: 1 + create: True +- when: (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution == "Scientific" or yum_config_file.stat.exists) ++ when: (ansible_distribution == "RedHat" or ansible_distribution == "CentOS" or ansible_distribution == "Scientific" or ansible_distribution == "AlmaLinux" or yum_config_file.stat.exists) - replace_or_append '{{{ pkg_manager_config_file }}}' '^localpkg_gpgcheck' '1' '@CCENUM@' + - name: Ensure GPG check Enabled for Local Packages (DNF) + ini_file: diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/rule.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/rule.yml -index 54a584cc..70b854df 100644 +index 0f2bd164..de00472e 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/rule.yml +++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_local_packages/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,wrlinux1019 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,wrlinux1019 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,wrlinux1019 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,wrlinux1019 title: 'Ensure gpgcheck Enabled for Local Packages' @@ -40,7 +40,7 @@ references: - iso27001-2013: A.12.1.2,A.12.5.1,A.12.6.2,A.14.2.2,A.14.2.3,A.14.2.4 - cis-csc: 11,3,9 - anssi: BP28(R15) + srg: SRG-OS-000366-GPOS-00153 + stigid@ol7: OL07-00-020060 + stigid@rhel7: RHEL-07-020060 - stigid@rhel8: RHEL-08-010371 + stigid@almalinux8: RHEL-08-010371 + vmmsrg: SRG-OS-000366-VMM-001430,SRG-OS-000370-VMM-001460,SRG-OS-000404-VMM-001650 ocil_clause: 'gpgcheck is not enabled or configured correctly to verify local packages' - diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/ansible/shared.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/ansible/shared.yml -index 05d707d1..eca20407 100644 +index a8cfc6e5..4ff55004 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/ansible/shared.yml +++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/ansible/shared.yml @@ -1,4 +1,4 @@ @@ -29223,19 +25580,19 @@ index a9b33d87..b1c33b4b 100644 +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_ol,multi_platform_fedora,multi_platform_rhv sed -i 's/gpgcheck\s*=.*/gpgcheck=1/g' /etc/yum.repos.d/* diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml -index e9c7f707..ce49ab61 100644 +index 85666c5f..7af9b6da 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml +++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_never_disabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4 title: 'Ensure gpgcheck Enabled for All {{{ pkg_manager }}} Package Repositories' diff --git a/linux_os/guide/system/software/updating/ensure_gpgcheck_repo_metadata/rule.yml b/linux_os/guide/system/software/updating/ensure_gpgcheck_repo_metadata/rule.yml -index 1dc15ec6..e81f7f5d 100644 +index be2c7aa1..40ff5875 100644 --- a/linux_os/guide/system/software/updating/ensure_gpgcheck_repo_metadata/rule.yml +++ b/linux_os/guide/system/software/updating/ensure_gpgcheck_repo_metadata/rule.yml @@ -1,6 +1,6 @@ @@ -29247,14 +25604,14 @@ index 1dc15ec6..e81f7f5d 100644 title: 'Ensure gpgcheck Enabled for Repository Metadata' diff --git a/linux_os/guide/system/software/updating/package_dnf-automatic_installed/rule.yml b/linux_os/guide/system/software/updating/package_dnf-automatic_installed/rule.yml -index 2c4b739e..6f59f28b 100644 +index dd52ba7e..18365b4b 100644 --- a/linux_os/guide/system/software/updating/package_dnf-automatic_installed/rule.yml +++ b/linux_os/guide/system/software/updating/package_dnf-automatic_installed/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8 -+prodtype: fedora,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 title: 'Install dnf-automatic Package' @@ -29269,14 +25626,14 @@ index 70de60d2..18a53cc0 100644 # strategy = patch # complexity = low diff --git a/linux_os/guide/system/software/updating/security_patches_up_to_date/rule.yml b/linux_os/guide/system/software/updating/security_patches_up_to_date/rule.yml -index 32f67fe0..5c62fda1 100644 +index 85c56011..89741252 100644 --- a/linux_os/guide/system/software/updating/security_patches_up_to_date/rule.yml +++ b/linux_os/guide/system/software/updating/security_patches_up_to_date/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol7,ol8,rhel7,rhel8,rhv4,sle12,sle15,ubuntu1604,ubuntu1804 -+prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhv4,sle12,sle15,ubuntu1604,ubuntu1804 +-prodtype: fedora,ol7,ol8,rhel7,rhel8,rhel9,rhv4,sle12,sle15,ubuntu1604,ubuntu1804 ++prodtype: fedora,ol7,ol8,rhel7,rhel8,almalinux8,rhel9,rhv4,sle12,sle15,ubuntu1604,ubuntu1804 title: 'Ensure Software Patches Installed' @@ -29292,27 +25649,5851 @@ index 32f67fe0..5c62fda1 100644 {{% elif product in ["sle12", "sle15"] %}} If the system is configured for online updates, invoking the following command will list available security updates: -@@ -59,7 +64,7 @@ references: - iso27001-2013: A.12.6.1,A.14.2.3,A.16.1.3,A.18.2.2,A.18.2.3 - cis-csc: 18,20,4 - anssi: BP28(R08) +@@ -62,7 +67,7 @@ references: + srg: SRG-OS-000480-GPOS-00227 + stigid@ol7: OL07-00-020260 + stigid@rhel7: RHEL-07-020260 - stigid@rhel8: RHEL-08-010010 + stigid@almalinux8: RHEL-08-010010 - - - # SCAP 1.3 content should reference flat non compressed xml files + stigid@sle12: SLES-12-010010 + stigid@sle15: SLES-15-010010 + vmmsrg: SRG-OS-000480-VMM-002000 diff --git a/linux_os/guide/system/software/updating/timer_dnf-automatic_enabled/rule.yml b/linux_os/guide/system/software/updating/timer_dnf-automatic_enabled/rule.yml -index 38a3d8ac..f53a9057 100644 +index f0ae5076..8936b05c 100644 --- a/linux_os/guide/system/software/updating/timer_dnf-automatic_enabled/rule.yml +++ b/linux_os/guide/system/software/updating/timer_dnf-automatic_enabled/rule.yml @@ -1,6 +1,6 @@ documentation_complete: true --prodtype: fedora,ol8,rhel8 -+prodtype: fedora,ol8,rhel8,almalinux8 +-prodtype: fedora,ol8,rhel8,rhel9 ++prodtype: fedora,ol8,rhel8,almalinux8,rhel9 title: Enable dnf-automatic Timer +diff --git a/products/almalinux8/CMakeLists.txt b/products/almalinux8/CMakeLists.txt +new file mode 100644 +index 00000000..c1ac2802 +--- /dev/null ++++ b/products/almalinux8/CMakeLists.txt +@@ -0,0 +1,28 @@ ++# Sometimes our users will try to do: "cd almalinux8; cmake ." That needs to error in a nice way. ++if ("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") ++ message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!") ++endif() ++ ++set(PRODUCT "almalinux8") ++set(DISA_SRG_TYPE "os") ++ ++ssg_build_product(${PRODUCT}) ++ ++ssg_build_html_table_by_ref(${PRODUCT} "nist") ++ssg_build_html_table_by_ref(${PRODUCT} "cui") ++ssg_build_html_table_by_ref(${PRODUCT} "cis") ++ssg_build_html_table_by_ref(${PRODUCT} "pcidss") ++ssg_build_html_table_by_ref(${PRODUCT} "anssi") ++ ++ssg_build_html_nistrefs_table(${PRODUCT} "ospp") ++ssg_build_html_nistrefs_table(${PRODUCT} "stig") ++ ++ssg_build_html_cce_table(${PRODUCT}) ++ ++ssg_build_html_srgmap_tables(${PRODUCT} "stig" ${DISA_SRG_TYPE}) ++ ++ssg_build_html_stig_tables(${PRODUCT}) ++ssg_build_html_stig_tables_per_profile( ${PRODUCT} "stig") ++ssg_build_html_stig_tables_per_profile( ${PRODUCT} "stig_gui") ++ ++#ssg_build_html_stig_tables(${PRODUCT} "ospp") +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_enhanced-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_enhanced-ks.cfg +new file mode 100644 +index 00000000..b6701749 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_enhanced-ks.cfg +@@ -0,0 +1,163 @@ ++# SCAP Security Guide ANSSI BP-028 (enhanced) profile kickstart for AlmaLinux 8 ++# Version: 0.0.1 ++# Date: 2021-01-28 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow ++# Ensure /usr Located On Separate Partition ++logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev" ++# Ensure /opt Located On Separate Partition ++logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" ++# Ensure /srv Located On Separate Partition ++logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" ++logvol swap --name=swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_high-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_high-ks.cfg +new file mode 100644 +index 00000000..fe272bb1 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_high-ks.cfg +@@ -0,0 +1,167 @@ ++# SCAP Security Guide ANSSI BP-028 (high) profile kickstart for AlmaLinux 8 ++# Version: 0.0.1 ++# Date: 2020-12-10 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow ++# Ensure /usr Located On Separate Partition ++logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev" ++# Ensure /opt Located On Separate Partition ++logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" ++# Ensure /srv Located On Separate Partition ++logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" ++logvol swap --name=swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_anssi_bp28_high ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_intermediary-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_intermediary-ks.cfg +new file mode 100644 +index 00000000..99294f42 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_intermediary-ks.cfg +@@ -0,0 +1,163 @@ ++# SCAP Security Guide ANSSI BP-028 (intermediary) profile kickstart for AlmaLinux 8 ++# Version: 0.0.1 ++# Date: 2021-01-28 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow ++# Ensure /usr Located On Separate Partition ++logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev" ++# Ensure /opt Located On Separate Partition ++logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" ++# Ensure /srv Located On Separate Partition ++logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" ++logvol swap --name=swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_minimal-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_minimal-ks.cfg +new file mode 100644 +index 00000000..4fbcdb6a +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-anssi_bp28_minimal-ks.cfg +@@ -0,0 +1,127 @@ ++# SCAP Security Guide ANSSI BP-028 (minimal) profile kickstart for AlmaLinux 8 ++# Version: 0.0.1 ++# Date: 2021-01-28 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++autopart ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_anssi_bp28_minimal ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-cis-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-cis-ks.cfg +new file mode 100644 +index 00000000..200beffb +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-cis-ks.cfg +@@ -0,0 +1,143 @@ ++# SCAP Security Guide CIS profile (Level 2 - Server) kickstart for AlmaLinux 8 Server ++# Version: 0.0.1 ++# Date: 2021-08-12 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --device eth0 --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# sssd profile sets sha512 to hash passwords ++# passwords are shadowed by default ++# See the manual page for authselect-profile for a complete list of possible options. ++authselect select sssd ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=3072 ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512 ++logvol swap --name=lv_swap --vgname=VolGroup --size=2016 ++ ++ ++# Harden installation with CIS profile ++# For more details and configuration options see ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_cis ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-cis_server_l1-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-cis_server_l1-ks.cfg +new file mode 100644 +index 00000000..d5474115 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-cis_server_l1-ks.cfg +@@ -0,0 +1,133 @@ ++# SCAP Security Guide CIS profile (Level 1 - Server) kickstart for AlmaLinux 8 Server ++# Version: 0.0.1 ++# Date: 2021-08-12 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --device eth0 --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# sssd profile sets sha512 to hash passwords ++# passwords are shadowed by default ++# See the manual page for authselect-profile for a complete list of possible options. ++authselect select sssd ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid" ++logvol swap --name=lv_swap --vgname=VolGroup --size=2016 ++ ++ ++# Harden installation with CIS profile ++# For more details and configuration options see ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_cis_server_l1 ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-cis_workstation_l1-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-cis_workstation_l1-ks.cfg +new file mode 100644 +index 00000000..2cabaa30 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-cis_workstation_l1-ks.cfg +@@ -0,0 +1,133 @@ ++# SCAP Security Guide CIS profile (Level 1 - Workstation) kickstart for AlmaLinux 8 Server ++# Version: 0.0.1 ++# Date: 2021-08-12 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --device eth0 --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# sssd profile sets sha512 to hash passwords ++# passwords are shadowed by default ++# See the manual page for authselect-profile for a complete list of possible options. ++authselect select sssd ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid" ++logvol swap --name=lv_swap --vgname=VolGroup --size=2016 ++ ++ ++# Harden installation with CIS profile ++# For more details and configuration options see ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_cis_workstation_l1 ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-cis_workstation_l2-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-cis_workstation_l2-ks.cfg +new file mode 100644 +index 00000000..09b19c64 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-cis_workstation_l2-ks.cfg +@@ -0,0 +1,143 @@ ++# SCAP Security Guide CIS profile (Level 2 - Workstation) kickstart for AlmaLinux 8 Server ++# Version: 0.0.1 ++# Date: 2021-08-12 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --device eth0 --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# sssd profile sets sha512 to hash passwords ++# passwords are shadowed by default ++# See the manual page for authselect-profile for a complete list of possible options. ++authselect select sssd ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=10240 --grow ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=LogVol7 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=3072 ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512 ++logvol swap --name=lv_swap --vgname=VolGroup --size=2016 ++ ++ ++# Harden installation with CIS profile ++# For more details and configuration options see ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_cis_workstation_l2 ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-cui-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-cui-ks.cfg +new file mode 100644 +index 00000000..69239029 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-cui-ks.cfg +@@ -0,0 +1,164 @@ ++# SCAP Security Guide CUI profile kickstart for AlmaLinux 8 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# --enableshadow enable shadowed passwords by default ++# --passalgo hash / crypt algorithm for new passwords ++# See the manual page for authconfig for a complete list of possible options. ++authconfig --enableshadow --passalgo=sha512 ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=root --vgname=VolGroup --size=10240 --grow ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" ++logvol swap --name=swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_cui ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-e8-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-e8-ks.cfg +new file mode 100644 +index 00000000..4f4aa074 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-e8-ks.cfg +@@ -0,0 +1,122 @@ ++# SCAP Security Guide Essential Eight profile kickstart for AlmaLinux 8 Server ++# Version: 0.0.1 ++# Date: 2019-11-13 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --device eth0 --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# sssd profile sets sha512 to hash passwords ++# passwords are shadowed by default ++# See the manual page for authselect-profile for a complete list of possible options. ++authselect select sssd ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++autopart ++ ++# Harden installation with Essential Eight profile ++# For more details and configuration options see ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_e8 ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-hipaa-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-hipaa-ks.cfg +new file mode 100644 +index 00000000..7af28b5b +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-hipaa-ks.cfg +@@ -0,0 +1,122 @@ ++# SCAP Security Guide HIPAA profile kickstart for AlmaLinux 8 Server ++# Version: 0.0.1 ++# Date: 2020-05-25 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --device eth0 --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# sssd profile sets sha512 to hash passwords ++# passwords are shadowed by default ++# See the manual page for authselect-profile for a complete list of possible options. ++authselect select sssd ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++autopart ++ ++# Harden installation with HIPAA profile ++# For more details and configuration options see ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_hipaa ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-ism_o-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-ism_o-ks.cfg +new file mode 100644 +index 00000000..4f469518 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-ism_o-ks.cfg +@@ -0,0 +1,116 @@ ++# SCAP Security Guide ISM Official profile kickstart for AlmaLinux 8 Server ++# Version: 0.0.1 ++# Date: 2021-08-16 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#performing_an_automated_installation_using_kickstart ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# ++network --onboot yes --device eth0 --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw to see how to create ++# encrypted password form for different plaintext password ++rootpw --iscrypted $6$/0RYeeRdK70ynvYz$jH2ZN/80HM6DjndHMxfUF9KIibwipitvizzXDH1zW.fTjyD3RD3tkNdNUaND18B/XqfAUW3vy1uebkBybCuIm0 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# sssd profile sets sha512 to hash passwords ++# passwords are shadowed by default ++# See the manual page for authselect-profile for a complete list of possible options. ++authselect select sssd ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++bootloader --location=mbr --append="crashkernel=auto rhgb quiet" ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++autopart ++ ++# Harden installation with Essential Eight profile ++# For more details and configuration options see ++# https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/performing_an_advanced_rhel_installation/index#addon-org_fedora_oscap_kickstart-commands-for-addons-supplied-with-the-rhel-installation-program ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_ism_o ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-ospp-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-ospp-ks.cfg +new file mode 100644 +index 00000000..3b3996d9 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-ospp-ks.cfg +@@ -0,0 +1,164 @@ ++# SCAP Security Guide OSPP profile kickstart for AlmaLinux 8 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# --enableshadow enable shadowed passwords by default ++# --passalgo hash / crypt algorithm for new passwords ++# See the manual page for authconfig for a complete list of possible options. ++authconfig --enableshadow --passalgo=sha512 ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=root --vgname=VolGroup --size=10240 --grow ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" ++logvol swap --name=swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_ospp ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-pci-dss-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-pci-dss-ks.cfg +new file mode 100644 +index 00000000..a2149a90 +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-pci-dss-ks.cfg +@@ -0,0 +1,154 @@ ++# SCAP Security Guide PCI-DSS profile kickstart for AlmaLinux 8 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++ ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++network --onboot yes --bootproto dhcp --noipv6 ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# --enableshadow enable shadowed passwords by default ++# --passalgo hash / crypt algorithm for new passwords ++# See the manual page for authconfig for a complete list of possible options. ++authconfig --enableshadow --passalgo=sha512 ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++# ++# PASSWORD TEMPORARILY DISABLED ++bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" ++#bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=11264 --grow ++# CCE-26557-9: Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=LogVol02 --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# CCE-26435-8: Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=LogVol01 --vgname=VolGroup --size=1024 --fsoptions="nodev,noexec,nosuid" ++# CCE-26639-5: Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=LogVol03 --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# CCE-26215-4: Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=LogVol04 --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# CCE-26436-6: Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=LogVol05 --vgname=VolGroup --size=512 --fsoptions="nodev" ++logvol swap --name=lv_swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_pci-dss ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-stig-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-stig-ks.cfg +new file mode 100644 +index 00000000..7ac37fbd +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-stig-ks.cfg +@@ -0,0 +1,165 @@ ++# SCAP Security Guide STIG profile kickstart for AlmaLinux 8 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# --enableshadow enable shadowed passwords by default ++# --passalgo hash / crypt algorithm for new passwords ++# See the manual page for authconfig for a complete list of possible options. ++authconfig --enableshadow --passalgo=sha512 ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=root --vgname=VolGroup --size=10240 --grow ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=10240 --fsoptions="nodev,nosuid,noexec" ++logvol swap --name=swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_stig ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/kickstart/ssg-almalinux8-stig_gui-ks.cfg b/products/almalinux8/kickstart/ssg-almalinux8-stig_gui-ks.cfg +new file mode 100644 +index 00000000..4d7d477e +--- /dev/null ++++ b/products/almalinux8/kickstart/ssg-almalinux8-stig_gui-ks.cfg +@@ -0,0 +1,165 @@ ++# SCAP Security Guide STIG with GUI profile kickstart for AlmaLinux 8 ++# ++# Based on: ++# https://pykickstart.readthedocs.io/en/latest/ ++# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg ++ ++# Specify installation method to use for installation ++# To use a different one comment out the 'url' one below, update ++# the selected choice with proper options & un-comment it ++# ++# Install from an installation tree on a remote server via FTP or HTTP: ++# --url the URL to install from ++# ++# Example: ++# ++# url --url=http://192.168.122.1/image ++# ++# Modify concrete URL in the above example appropriately to reflect the actual ++# environment machine is to be installed in ++# ++# Other possible / supported installation methods: ++# * install from the first CD-ROM/DVD drive on the system: ++# ++# cdrom ++# ++# * install from a directory of ISO images on a local drive: ++# ++# harddrive --partition=hdb2 --dir=/tmp/install-tree ++# ++# * install from provided NFS server: ++# ++# nfs --server=<hostname> --dir=<directory> [--opts=<nfs options>] ++# ++# Set language to use during installation and the default language to use on the installed system (required) ++lang en_US.UTF-8 ++ ++# Set system keyboard type / layout (required) ++keyboard us ++ ++# Configure network information for target system and activate network devices in the installer environment (optional) ++# --onboot enable device at a boot time ++# --device device to be activated and / or configured with the network command ++# --bootproto method to obtain networking configuration for device (default dhcp) ++# --noipv6 disable IPv6 on this device ++# ++# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, ++# "--bootproto=static" must be used. For example: ++# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 ++# ++network --onboot yes --bootproto dhcp ++ ++# Set the system's root password (required) ++# Plaintext password is: server ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 ++ ++# The selected profile will restrict root login ++# Add a user that can login and escalate privileges ++# Plaintext password is: admin123 ++user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted ++ ++# Configure firewall settings for the system (optional) ++# --enabled reject incoming connections that are not in response to outbound requests ++# --ssh allow sshd service through the firewall ++firewall --enabled --ssh ++ ++# Set up the authentication options for the system (required) ++# --enableshadow enable shadowed passwords by default ++# --passalgo hash / crypt algorithm for new passwords ++# See the manual page for authconfig for a complete list of possible options. ++authconfig --enableshadow --passalgo=sha512 ++ ++# State of SELinux on the installed system (optional) ++# Defaults to enforcing ++selinux --enforcing ++ ++# Set the system time zone (required) ++timezone --utc America/New_York ++ ++# Specify how the bootloader should be installed (required) ++# Plaintext password is: password ++# Refer to e.g. ++# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw ++# to see how to create encrypted password form for different plaintext password ++bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192 slub_debug=P page_poison=1 vsyscall=none" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 ++ ++# Initialize (format) all disks (optional) ++zerombr ++ ++# The following partition layout scheme assumes disk of size 20GB or larger ++# Modify size of partitions appropriately to reflect actual machine's hardware ++# ++# Remove Linux partitions from the system prior to creating new ones (optional) ++# --linux erase all Linux partitions ++# --initlabel initialize the disk label to the default based on the underlying architecture ++clearpart --linux --initlabel ++ ++# Create primary system partitions (required for installs) ++part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" ++part pv.01 --grow --size=1 ++ ++# Create a Logical Volume Management (LVM) group (optional) ++volgroup VolGroup --pesize=4096 pv.01 ++ ++# Create particular logical volumes (optional) ++logvol / --fstype=xfs --name=root --vgname=VolGroup --size=10240 --grow ++# Ensure /home Located On Separate Partition ++logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" ++# Ensure /tmp Located On Separate Partition ++logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/tmp Located On Separate Partition ++logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var Located On Separate Partition ++logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" ++# Ensure /var/log Located On Separate Partition ++logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" ++# Ensure /var/log/audit Located On Separate Partition ++logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=10240 --fsoptions="nodev,nosuid,noexec" ++logvol swap --name=swap --vgname=VolGroup --size=2016 ++ ++# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) ++# content - security policies - on the installed system.This add-on has been enabled by default ++# since RHEL 7.2. When enabled, the packages necessary to provide this ++# functionality will automatically be installed. However, by default, no policies are enforced, ++# meaning that no checks are performed during or after installation unless specifically configured. ++# ++# Important ++# Applying a security policy is not necessary on all systems. This screen should only be used ++# when a specific policy is mandated by your organization rules or government regulations. ++# Unlike most other commands, this add-on does not accept regular options, but uses key-value ++# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. ++# Values can be optionally enclosed in single quotes (') or double quotes ("). ++# ++# The following keys are recognized by the add-on: ++# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. ++# - If the content-type is scap-security-guide, the add-on will use content provided by the ++# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. ++# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. ++# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. ++# xccdf-id - ID of the benchmark you want to use. ++# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. ++# profile - ID of the profile to be applied. Use default to apply the default profile. ++# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. ++# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. ++# ++# The following is an example %addon org_fedora_oscap section which uses content from the ++# scap-security-guide on the installation media: ++%addon org_fedora_oscap ++ content-type = scap-security-guide ++ profile = xccdf_org.ssgproject.content_profile_stig_gui ++%end ++ ++# Packages selection (%packages section is required) ++%packages ++ ++# Require @Base ++@Base ++ ++%end # End of %packages section ++ ++# Reboot after the installation is complete (optional) ++# --eject attempt to eject CD or DVD media before rebooting ++reboot --eject +diff --git a/products/almalinux8/overlays/srg_support.xml b/products/almalinux8/overlays/srg_support.xml +new file mode 100644 +index 00000000..08c87ea6 +--- /dev/null ++++ b/products/almalinux8/overlays/srg_support.xml +@@ -0,0 +1,173 @@ ++<Group id="srg_support" hidden="true"> ++<title>Documentation to Support DISA OS SRG Mapping ++These groups exist to document how the AlmaLinux ++product meets (or does not meet) requirements listed in the DISA OS SRG, for ++those cases where Groups or Rules elsewhere in scap-security-guide do ++not clearly relate. ++ ++ ++ ++ ++ ++Product Meets this Requirement ++ ++AlmaLinux meets this requirement through design and implementation. ++ ++AlmaLinux 8 supports this requirement and cannot be configured to be out of ++compliance. This is a permanent not a finding. ++ ++ ++This requirement is a permanent not a finding. No fix is required. ++ ++ ++ ++ ++ ++ ++ ++ ++Product Meets this Requirement ++ ++The AlmaLinux audit system meets this requirement through design and implementation. ++ ++The AlmaLinux 8 auditing system supports this requirement and cannot be configured to be out of ++compliance. Every audit record in AlmaLinux includes a timestamp, the operation attempted, ++success or failure of the operation, the subject involved (executable/process), ++the object involved (file/path), and security labels for the subject and object. ++It also includes the ability to label events with custom key labels. The auditing system ++centralizes the recording of audit events for the entire system and includes ++reduction (ausearch), reporting (aureport), and real-time ++response (audispd) facilities. ++This is a permanent not a finding. ++ ++ ++This requirement is a permanent not a finding. No fix is required. ++ ++ ++ ++ ++ ++ ++ ++ ++Product Meets this Requirement ++ ++AlmaLinux meets this requirement through design and implementation. ++ ++AlmaLinux 8 supports this requirement and cannot be configured to be out of ++compliance. This is a permanent not a finding. ++ ++ ++This requirement is a permanent not a finding. No fix is required. ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++Guidance Does Not Meet this Requirement Due to Impracticality or Scope ++ ++The guidance does not meet this requirement. ++The requirement is impractical or out of scope. ++ ++ ++AlmaLinux 8 cannot support this requirement without assistance from an external ++application, policy, or service. This requirement is NA. ++ ++ ++This requirement is NA. No fix is required. ++ ++ ++ ++ ++ ++ ++ ++ ++Implementation of the Requirement is Not Supported ++ ++AlmaLinux 8 does not support this requirement. ++ ++ ++This is a permanent finding. ++ ++ ++This requirement is a permanent finding and cannot be fixed. An appropriate ++mitigation for the system must be implemented but this finding cannot be ++considered fixed. ++ ++ ++ ++ ++ ++ ++ ++ ++Guidance Does Not Meet this Requirement Due to Impracticality or Scope ++ ++The guidance does not meet this requirement. ++The requirement is impractical or out of scope. ++ ++ ++AlmaLinux 8 cannot support this requirement without assistance from an external ++application, policy, or service. This requirement is NA. ++ ++ ++This requirement is NA. No fix is required. ++ ++ ++ ++ ++ ++ ++A process for prompt installation of OS updates must exist. ++ ++This is a manual inquiry about update procedure. ++ ++ ++Ask an administrator if a process exists to promptly and automatically apply OS ++software updates. If such a process does not exist, this is a finding. ++

++If the OS update process limits automatic updates of software packages, where ++such updates would impede normal system operation, to scheduled maintenance ++windows, but still within IAVM-dictated timeframes, this is not a finding. ++ ++ ++Procedures to promptly apply software updates must be established and ++executed. The AlmaLinux operating system provides support for automating such a ++process, by running the yum program through a cron job or by managing the ++system and its packages through the Foreman. ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/product.yml b/products/almalinux8/product.yml +new file mode 100644 +index 00000000..052ac73e +--- /dev/null ++++ b/products/almalinux8/product.yml +@@ -0,0 +1,27 @@ ++product: almalinux8 ++full_name: AlmaLinux 8 ++type: platform ++ ++benchmark_root: "../../linux_os/guide" ++ ++profiles_root: "./profiles" ++ ++pkg_manager: "yum" ++ ++init_system: "systemd" ++ ++oval_feed_url: "https://security.almalinux.org/oval/org.almalinux.alsa-8.xml" ++ ++pkg_release: "5ffd890e" ++pkg_version: "3abb34f8" ++ ++cpes_root: "../../shared/applicability" ++cpes: ++ - almalinux8: ++ name: "cpe:/o:almalinux:almalinux:8" ++ title: "AlmaLinux 8" ++ check_id: installed_OS_is_almalinux8 ++ ++# Mapping of CPE platform to package ++platform_package_overrides: ++ login_defs: "shadow-utils" +diff --git a/products/almalinux8/profiles/anssi_bp28_enhanced.profile b/products/almalinux8/profiles/anssi_bp28_enhanced.profile +new file mode 100644 +index 00000000..4a34d1e2 +--- /dev/null ++++ b/products/almalinux8/profiles/anssi_bp28_enhanced.profile +@@ -0,0 +1,16 @@ ++documentation_complete: true ++ ++title: 'ANSSI-BP-028 (enhanced)' ++ ++description: |- ++ This profile contains configurations that align to ANSSI-BP-028 v1.2 at the enhanced hardening level. ++ ++ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ++ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. ++ ++ A copy of the ANSSI-BP-028 can be found at the ANSSI website: ++ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ ++ ++selections: ++ - anssi:all:enhanced ++ - '!selinux_state' +diff --git a/products/almalinux8/profiles/anssi_bp28_high.profile b/products/almalinux8/profiles/anssi_bp28_high.profile +new file mode 100644 +index 00000000..5336db82 +--- /dev/null ++++ b/products/almalinux8/profiles/anssi_bp28_high.profile +@@ -0,0 +1,15 @@ ++documentation_complete: true ++ ++title: 'ANSSI-BP-028 (high)' ++ ++description: |- ++ This profile contains configurations that align to ANSSI-BP-028 v1.2 at the high hardening level. ++ ++ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ++ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. ++ ++ A copy of the ANSSI-BP-028 can be found at the ANSSI website: ++ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ ++ ++selections: ++ - anssi:all:high +diff --git a/products/almalinux8/profiles/anssi_bp28_intermediary.profile b/products/almalinux8/profiles/anssi_bp28_intermediary.profile +new file mode 100644 +index 00000000..5b7bcebb +--- /dev/null ++++ b/products/almalinux8/profiles/anssi_bp28_intermediary.profile +@@ -0,0 +1,15 @@ ++documentation_complete: true ++ ++title: 'ANSSI-BP-028 (intermediary)' ++ ++description: |- ++ This profile contains configurations that align to ANSSI-BP-028 v1.2 at the intermediary hardening level. ++ ++ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ++ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. ++ ++ A copy of the ANSSI-BP-028 can be found at the ANSSI website: ++ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ ++ ++selections: ++ - anssi:all:intermediary +diff --git a/products/almalinux8/profiles/anssi_bp28_minimal.profile b/products/almalinux8/profiles/anssi_bp28_minimal.profile +new file mode 100644 +index 00000000..b3fc48f8 +--- /dev/null ++++ b/products/almalinux8/profiles/anssi_bp28_minimal.profile +@@ -0,0 +1,16 @@ ++documentation_complete: true ++ ++title: 'ANSSI-BP-028 (minimal)' ++ ++description: |- ++ This profile contains configurations that align to ANSSI-BP-028 v1.2 at the minimal hardening level. ++ ++ ANSSI is the French National Information Security Agency, and stands for Agence nationale de la sécurité des systèmes d'information. ++ ANSSI-BP-028 is a configuration recommendation for GNU/Linux systems. ++ ++ A copy of the ANSSI-BP-028 can be found at the ANSSI website: ++ https://www.ssi.gouv.fr/administration/guide/recommandations-de-securite-relatives-a-un-systeme-gnulinux/ ++ ++selections: ++ - anssi:all:minimal ++ +diff --git a/products/almalinux8/profiles/cis.profile b/products/almalinux8/profiles/cis.profile +new file mode 100644 +index 00000000..d598a219 +--- /dev/null ++++ b/products/almalinux8/profiles/cis.profile +@@ -0,0 +1,22 @@ ++documentation_complete: true ++ ++metadata: ++ version: 1.0.0 ++ SMEs: ++ - vojtapolasek ++ - yuumasato ++ ++reference: https://www.cisecurity.org/benchmark/almalinux/ ++ ++title: 'CIS AlmaLinux OS 8 Benchmark for Level 2 - Server' ++ ++description: |- ++ This profile defines a baseline that aligns to the "Level 2 - Server" ++ configuration from the Center for Internet Security® ++ AlmaLinux OS 8 Benchmark™, v1.0.0, released 10-22-2021. ++ ++ This profile includes Center for Internet Security® ++ AlmaLinux OS 8 CIS Benchmarks™ content. ++ ++selections: ++ - cis_rhel8:all:l2_server +diff --git a/products/almalinux8/profiles/cis_server_l1.profile b/products/almalinux8/profiles/cis_server_l1.profile +new file mode 100644 +index 00000000..050a7789 +--- /dev/null ++++ b/products/almalinux8/profiles/cis_server_l1.profile +@@ -0,0 +1,22 @@ ++documentation_complete: true ++ ++metadata: ++ version: 1.0.0 ++ SMEs: ++ - vojtapolasek ++ - yuumasato ++ ++reference: https://www.cisecurity.org/benchmark/almalinux/ ++ ++title: 'CIS AlmaLinux OS 8 Benchmark for Level 1 - Server' ++ ++description: |- ++ This profile defines a baseline that aligns to the "Level 1 - Server" ++ configuration from the Center for Internet Security® ++ AlmaLinux OS 8 Benchmark™, v1.0.0, released 10-22-2021. ++ ++ This profile includes Center for Internet Security® ++ AlmaLinux OS 8 CIS Benchmarks™ content. ++ ++selections: ++ - cis_rhel8:all:l1_server +diff --git a/products/almalinux8/profiles/cis_workstation_l1.profile b/products/almalinux8/profiles/cis_workstation_l1.profile +new file mode 100644 +index 00000000..8ffc95a4 +--- /dev/null ++++ b/products/almalinux8/profiles/cis_workstation_l1.profile +@@ -0,0 +1,22 @@ ++documentation_complete: true ++ ++metadata: ++ version: 1.0.0 ++ SMEs: ++ - vojtapolasek ++ - yuumasato ++ ++reference: https://www.cisecurity.org/benchmark/almalinux/ ++ ++title: 'CIS AlmaLinux OS 8 Benchmark for Level 1 - Workstation' ++ ++description: |- ++ This profile defines a baseline that aligns to the "Level 1 - Workstation" ++ configuration from the Center for Internet Security® ++ AlmaLinux OS 8 Benchmark™, v1.0.0, released 10-22-2021. ++ ++ This profile includes Center for Internet Security® ++ AlmaLinux OS 8 CIS Benchmarks™ content. ++ ++selections: ++ - cis_rhel8:all:l1_workstation +diff --git a/products/almalinux8/profiles/cis_workstation_l2.profile b/products/almalinux8/profiles/cis_workstation_l2.profile +new file mode 100644 +index 00000000..9df68893 +--- /dev/null ++++ b/products/almalinux8/profiles/cis_workstation_l2.profile +@@ -0,0 +1,22 @@ ++documentation_complete: true ++ ++metadata: ++ version: 1.0.0 ++ SMEs: ++ - vojtapolasek ++ - yuumasato ++ ++reference: https://www.cisecurity.org/benchmark/almalinux/ ++ ++title: 'CIS AlmaLinux OS 8 Benchmark for Level 2 - Workstation' ++ ++description: |- ++ This profile defines a baseline that aligns to the "Level 2 - Workstation" ++ configuration from the Center for Internet Security® ++ AlmaLinux OS 8 Benchmark™, v1.0.0, released 10-22-2021. ++ ++ This profile includes Center for Internet Security® ++ AlmaLinux OS 8 CIS Benchmarks™ content. ++ ++selections: ++ - cis_rhel8:all:l2_workstation +diff --git a/products/almalinux8/profiles/cjis.profile b/products/almalinux8/profiles/cjis.profile +new file mode 100644 +index 00000000..eec51034 +--- /dev/null ++++ b/products/almalinux8/profiles/cjis.profile +@@ -0,0 +1,140 @@ ++documentation_complete: false ++ ++metadata: ++ version: 5.4 ++ SMEs: ++ - carlosmmatos ++ ++reference: https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center ++ ++title: 'Criminal Justice Information Services (CJIS) Security Policy' ++ ++description: |- ++ This profile is derived from FBI's CJIS v5.4 ++ Security Policy. A copy of this policy can be found at the CJIS Security ++ Policy Resource Center: ++ ++ https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center ++ ++selections: ++ - service_auditd_enabled ++ - grub2_audit_argument ++ - auditd_data_retention_num_logs ++ - auditd_data_retention_max_log_file ++ - auditd_data_retention_max_log_file_action ++ - auditd_data_retention_space_left_action ++ - auditd_data_retention_admin_space_left_action ++ - auditd_data_retention_action_mail_acct ++ - auditd_audispd_syslog_plugin_activated ++ - audit_rules_time_adjtimex ++ - audit_rules_time_settimeofday ++ - audit_rules_time_stime ++ - audit_rules_time_clock_settime ++ - audit_rules_time_watch_localtime ++ - audit_rules_usergroup_modification ++ - audit_rules_networkconfig_modification ++ - file_permissions_var_log_audit ++ - file_ownership_var_log_audit ++ - audit_rules_mac_modification ++ - audit_rules_dac_modification_chmod ++ - audit_rules_dac_modification_chown ++ - audit_rules_dac_modification_fchmod ++ - audit_rules_dac_modification_fchmodat ++ - audit_rules_dac_modification_fchown ++ - audit_rules_dac_modification_fchownat ++ - audit_rules_dac_modification_fremovexattr ++ - audit_rules_dac_modification_fsetxattr ++ - audit_rules_dac_modification_lchown ++ - audit_rules_dac_modification_lremovexattr ++ - audit_rules_dac_modification_lsetxattr ++ - audit_rules_dac_modification_removexattr ++ - audit_rules_dac_modification_setxattr ++ - audit_rules_login_events ++ - audit_rules_session_events ++ - audit_rules_unsuccessful_file_modification ++ - audit_rules_privileged_commands ++ - audit_rules_media_export ++ - audit_rules_file_deletion_events ++ - audit_rules_sysadmin_actions ++ - audit_rules_kernel_module_loading ++ - audit_rules_immutable ++ - account_unique_name ++ - gid_passwd_group_same ++ - accounts_password_all_shadowed ++ - no_empty_passwords ++ - display_login_attempts ++ - var_accounts_password_minlen_login_defs=12 ++ - var_accounts_maximum_age_login_defs=90 ++ - var_password_pam_unix_remember=10 ++ - var_account_disable_post_pw_expiration=0 ++ - var_password_pam_minlen=12 ++ - var_accounts_minimum_age_login_defs=1 ++ - var_password_pam_difok=6 ++ - var_accounts_max_concurrent_login_sessions=3 ++ - account_disable_post_pw_expiration ++ - accounts_password_pam_minlen ++ - accounts_minimum_age_login_defs ++ - accounts_password_pam_difok ++ - accounts_max_concurrent_login_sessions ++ - set_password_hashing_algorithm_systemauth ++ - set_password_hashing_algorithm_logindefs ++ - set_password_hashing_algorithm_libuserconf ++ - file_owner_etc_shadow ++ - file_groupowner_etc_shadow ++ - file_permissions_etc_shadow ++ - file_owner_etc_group ++ - file_groupowner_etc_group ++ - file_permissions_etc_group ++ - file_owner_etc_passwd ++ - file_groupowner_etc_passwd ++ - file_permissions_etc_passwd ++ - file_owner_grub2_cfg ++ - file_groupowner_grub2_cfg ++ - var_password_pam_retry=5 ++ - var_accounts_passwords_pam_faillock_deny=5 ++ - var_accounts_passwords_pam_faillock_unlock_time=600 ++ - dconf_db_up_to_date ++ - dconf_gnome_screensaver_idle_delay ++ - dconf_gnome_screensaver_idle_activation_enabled ++ - dconf_gnome_screensaver_lock_enabled ++ - dconf_gnome_screensaver_mode_blank ++ - sshd_allow_only_protocol2 ++ - sshd_set_idle_timeout ++ - var_sshd_set_keepalive=0 ++ - sshd_set_keepalive_0 ++ - disable_host_auth ++ - sshd_disable_root_login ++ - sshd_disable_empty_passwords ++ - sshd_enable_warning_banner ++ - sshd_do_not_permit_user_env ++ - var_system_crypto_policy=fips ++ - configure_crypto_policy ++ - configure_ssh_crypto_policy ++ - kernel_module_dccp_disabled ++ - kernel_module_sctp_disabled ++ - service_firewalld_enabled ++ - set_firewalld_default_zone ++ - firewalld_sshd_port_enabled ++ - sshd_idle_timeout_value=30_minutes ++ - inactivity_timeout_value=30_minutes ++ - sysctl_net_ipv4_conf_default_accept_source_route ++ - sysctl_net_ipv4_tcp_syncookies ++ - sysctl_net_ipv4_conf_all_send_redirects ++ - sysctl_net_ipv4_conf_default_send_redirects ++ - sysctl_net_ipv4_conf_all_accept_redirects ++ - sysctl_net_ipv4_conf_default_accept_redirects ++ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts ++ - var_password_pam_ocredit=1 ++ - var_password_pam_dcredit=1 ++ - var_password_pam_ucredit=1 ++ - var_password_pam_lcredit=1 ++ - package_aide_installed ++ - aide_build_database ++ - aide_periodic_cron_checking ++ - rpm_verify_permissions ++ - rpm_verify_hashes ++ - ensure_almalinux_gpgkey_installed ++ - ensure_gpgcheck_globally_activated ++ - ensure_gpgcheck_never_disabled ++ - security_patches_up_to_date ++ - kernel_module_bluetooth_disabled +diff --git a/products/almalinux8/profiles/cui.profile b/products/almalinux8/profiles/cui.profile +new file mode 100644 +index 00000000..53197176 +--- /dev/null ++++ b/products/almalinux8/profiles/cui.profile +@@ -0,0 +1,32 @@ ++documentation_complete: true ++ ++metadata: ++ version: TBD ++ SMEs: ++ - carlosmmatos ++ ++title: 'Unclassified Information in Non-federal Information Systems and Organizations (NIST 800-171)' ++ ++description: |- ++ From NIST 800-171, Section 2.2: ++ Security requirements for protecting the confidentiality of CUI in nonfederal ++ information systems and organizations have a well-defined structure that ++ consists of: ++ ++ (i) a basic security requirements section; ++ (ii) a derived security requirements section. ++ ++ The basic security requirements are obtained from FIPS Publication 200, which ++ provides the high-level and fundamental security requirements for federal ++ information and information systems. The derived security requirements, which ++ supplement the basic security requirements, are taken from the security controls ++ in NIST Special Publication 800-53. ++ ++ This profile configures AlmaLinux 8 to the NIST Special ++ Publication 800-53 controls identified for securing Controlled Unclassified ++ Information (CUI)." ++ ++extends: ospp ++ ++selections: ++ - inactivity_timeout_value=10_minutes +diff --git a/products/almalinux8/profiles/e8.profile b/products/almalinux8/profiles/e8.profile +new file mode 100644 +index 00000000..d154b66f +--- /dev/null ++++ b/products/almalinux8/profiles/e8.profile +@@ -0,0 +1,149 @@ ++documentation_complete: true ++ ++metadata: ++ SMEs: ++ - shaneboulden ++ ++reference: https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers ++ ++title: 'Australian Cyber Security Centre (ACSC) Essential Eight' ++ ++description: |- ++ This profile contains configuration checks for AlmaLinux 8 ++ that align to the Australian Cyber Security Centre (ACSC) Essential Eight. ++ ++ A copy of the Essential Eight in Linux Environments guide can be found at the ++ ACSC website: ++ ++ https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers ++ ++selections: ++ ++ ### Remove obsolete packages ++ - package_talk_removed ++ - package_talk-server_removed ++ - package_xinetd_removed ++ - service_xinetd_disabled ++ - package_ypbind_removed ++ - package_telnet_removed ++ - service_telnet_disabled ++ - package_telnet-server_removed ++ - package_rsh_removed ++ - package_rsh-server_removed ++ - service_zebra_disabled ++ - package_quagga_removed ++ - service_avahi-daemon_disabled ++ - package_squid_removed ++ - service_squid_disabled ++ ++ ### Software update ++ - ensure_almalinux_gpgkey_installed ++ - ensure_gpgcheck_never_disabled ++ - ensure_gpgcheck_local_packages ++ - ensure_gpgcheck_globally_activated ++ - security_patches_up_to_date ++ - dnf-automatic_security_updates_only ++ ++ ### System security settings ++ - sysctl_kernel_randomize_va_space ++ - sysctl_kernel_exec_shield ++ - sysctl_kernel_kptr_restrict ++ - sysctl_kernel_dmesg_restrict ++ - sysctl_kernel_kexec_load_disabled ++ - sysctl_kernel_yama_ptrace_scope ++ - sysctl_kernel_unprivileged_bpf_disabled ++ - sysctl_net_core_bpf_jit_harden ++ ++ ### SELinux ++ - var_selinux_state=enforcing ++ - selinux_state ++ - var_selinux_policy_name=targeted ++ - selinux_policytype ++ ++ ### Filesystem integrity ++ - rpm_verify_hashes ++ - rpm_verify_permissions ++ - rpm_verify_ownership ++ - file_permissions_unauthorized_sgid ++ - file_permissions_unauthorized_suid ++ - file_permissions_unauthorized_world_writable ++ - dir_perms_world_writable_sticky_bits ++ - file_permissions_library_dirs ++ - file_ownership_binary_dirs ++ - file_permissions_binary_dirs ++ - file_ownership_library_dirs ++ ++ ### Passwords ++ - no_empty_passwords ++ ++ ### Partitioning ++ - mount_option_dev_shm_nodev ++ - mount_option_dev_shm_nosuid ++ - mount_option_dev_shm_noexec ++ ++ ### Network ++ - package_firewalld_installed ++ - service_firewalld_enabled ++ - network_sniffer_disabled ++ ++ ### Admin privileges ++ - accounts_no_uid_except_zero ++ - sudo_remove_nopasswd ++ - sudo_remove_no_authenticate ++ - sudo_require_authentication ++ ++ ### Audit ++ - package_rsyslog_installed ++ - service_rsyslog_enabled ++ - service_auditd_enabled ++ - var_auditd_flush=incremental_async ++ - auditd_data_retention_flush ++ - auditd_local_events ++ - auditd_write_logs ++ - auditd_log_format ++ - auditd_freq ++ - auditd_name_format ++ - audit_rules_login_events_tallylog ++ - audit_rules_login_events_faillock ++ - audit_rules_login_events_lastlog ++ - audit_rules_login_events ++ - audit_rules_time_adjtimex ++ - audit_rules_time_clock_settime ++ - audit_rules_time_watch_localtime ++ - audit_rules_time_settimeofday ++ - audit_rules_time_stime ++ - audit_rules_execution_restorecon ++ - audit_rules_execution_chcon ++ - audit_rules_execution_semanage ++ - audit_rules_execution_setsebool ++ - audit_rules_execution_setfiles ++ - audit_rules_execution_seunshare ++ - audit_rules_sysadmin_actions ++ - audit_rules_networkconfig_modification ++ - audit_rules_usergroup_modification ++ - audit_rules_dac_modification_chmod ++ - audit_rules_dac_modification_chown ++ - audit_rules_kernel_module_loading ++ ++ ### Secure access ++ - sshd_disable_root_login ++ - sshd_disable_gssapi_auth ++ - sshd_print_last_log ++ - sshd_do_not_permit_user_env ++ - sshd_disable_rhosts ++ - sshd_set_loglevel_info ++ - sshd_disable_empty_passwords ++ - sshd_disable_user_known_hosts ++ - sshd_enable_strictmodes ++ ++ # See also: https://www.cyber.gov.au/acsc/view-all-content/guidance/asd-approved-cryptographic-algorithms ++ - var_system_crypto_policy=default_nosha1 ++ - configure_crypto_policy ++ - configure_ssh_crypto_policy ++ ++ ### Application whitelisting ++ - package_fapolicyd_installed ++ - service_fapolicyd_enabled ++ ++ ### Backup ++ - package_rear_installed +diff --git a/products/almalinux8/profiles/hipaa.profile b/products/almalinux8/profiles/hipaa.profile +new file mode 100644 +index 00000000..43305cc2 +--- /dev/null ++++ b/products/almalinux8/profiles/hipaa.profile +@@ -0,0 +1,165 @@ ++documentation_complete: True ++ ++metadata: ++ SMEs: ++ - jjaswanson4 ++ - carlosmmatos ++ ++reference: https://www.hhs.gov/hipaa/for-professionals/index.html ++ ++title: 'Health Insurance Portability and Accountability Act (HIPAA)' ++ ++description: |- ++ The HIPAA Security Rule establishes U.S. national standards to protect individuals’ ++ electronic personal health information that is created, received, used, or ++ maintained by a covered entity. The Security Rule requires appropriate ++ administrative, physical and technical safeguards to ensure the ++ confidentiality, integrity, and security of electronic protected health ++ information. ++ ++ This profile configures AlmaLinux 8 to the HIPAA Security ++ Rule identified for securing of electronic protected health information. ++ Use of this profile in no way guarantees or makes claims against legal compliance against the HIPAA Security Rule(s). ++ ++selections: ++ - grub2_password ++ - grub2_uefi_password ++ - file_groupowner_grub2_cfg ++ - file_permissions_grub2_cfg ++ - file_owner_grub2_cfg ++ - grub2_disable_interactive_boot ++ - no_direct_root_logins ++ - no_empty_passwords ++ - require_singleuser_auth ++ - restrict_serial_port_logins ++ - securetty_root_login_console_only ++ - service_debug-shell_disabled ++ - disable_ctrlaltdel_reboot ++ - disable_ctrlaltdel_burstaction ++ - dconf_db_up_to_date ++ - dconf_gnome_remote_access_credential_prompt ++ - dconf_gnome_remote_access_encryption ++ - sshd_disable_empty_passwords ++ - sshd_disable_root_login ++ - libreswan_approved_tunnels ++ - no_rsh_trust_files ++ - package_rsh-server_removed ++ - package_talk_removed ++ - package_talk-server_removed ++ - package_telnet_removed ++ - package_telnet-server_removed ++ - package_xinetd_removed ++ - service_crond_enabled ++ - service_rexec_disabled ++ - service_rlogin_disabled ++ - service_telnet_disabled ++ - service_xinetd_disabled ++ - service_zebra_disabled ++ - use_kerberos_security_all_exports ++ - disable_host_auth ++ - sshd_allow_only_protocol2 ++ - sshd_disable_compression ++ - sshd_disable_gssapi_auth ++ - sshd_disable_kerb_auth ++ - sshd_do_not_permit_user_env ++ - sshd_enable_strictmodes ++ - sshd_enable_warning_banner ++ - var_sshd_set_keepalive=0 ++ - sshd_set_keepalive_0 ++ - encrypt_partitions ++ - var_system_crypto_policy=fips ++ - configure_crypto_policy ++ - configure_ssh_crypto_policy ++ - var_selinux_policy_name=targeted ++ - var_selinux_state=enforcing ++ - grub2_enable_selinux ++ - sebool_selinuxuser_execheap ++ - sebool_selinuxuser_execmod ++ - sebool_selinuxuser_execstack ++ - selinux_confinement_of_daemons ++ - selinux_policytype ++ - selinux_state ++ - service_kdump_disabled ++ - sysctl_fs_suid_dumpable ++ - sysctl_kernel_dmesg_restrict ++ - sysctl_kernel_exec_shield ++ - sysctl_kernel_randomize_va_space ++ - rpm_verify_hashes ++ - rpm_verify_permissions ++ - ensure_almalinux_gpgkey_installed ++ - ensure_gpgcheck_globally_activated ++ - ensure_gpgcheck_never_disabled ++ - ensure_gpgcheck_local_packages ++ - grub2_audit_argument ++ - service_auditd_enabled ++ - audit_rules_privileged_commands_sudo ++ - audit_rules_privileged_commands_su ++ - audit_rules_immutable ++ - kernel_module_usb-storage_disabled ++ - service_autofs_disabled ++ - auditd_audispd_syslog_plugin_activated ++ - rsyslog_remote_loghost ++ - auditd_data_retention_flush ++ - audit_rules_dac_modification_chmod ++ - audit_rules_dac_modification_chown ++ - audit_rules_dac_modification_fchmodat ++ - audit_rules_dac_modification_fchmod ++ - audit_rules_dac_modification_fchownat ++ - audit_rules_dac_modification_fchown ++ - audit_rules_dac_modification_fremovexattr ++ - audit_rules_dac_modification_fsetxattr ++ - audit_rules_dac_modification_lchown ++ - audit_rules_dac_modification_lremovexattr ++ - audit_rules_dac_modification_lsetxattr ++ - audit_rules_dac_modification_removexattr ++ - audit_rules_dac_modification_setxattr ++ - audit_rules_execution_chcon ++ - audit_rules_execution_restorecon ++ - audit_rules_execution_semanage ++ - audit_rules_execution_setsebool ++ - audit_rules_file_deletion_events_renameat ++ - audit_rules_file_deletion_events_rename ++ - audit_rules_file_deletion_events_rmdir ++ - audit_rules_file_deletion_events_unlinkat ++ - audit_rules_file_deletion_events_unlink ++ - audit_rules_kernel_module_loading_delete ++ - audit_rules_kernel_module_loading_init ++ - audit_rules_login_events_faillock ++ - audit_rules_login_events_lastlog ++ - audit_rules_login_events_tallylog ++ - audit_rules_mac_modification ++ - audit_rules_media_export ++ - audit_rules_networkconfig_modification ++ - audit_rules_privileged_commands_chage ++ - audit_rules_privileged_commands_chsh ++ - audit_rules_privileged_commands_crontab ++ - audit_rules_privileged_commands_gpasswd ++ - audit_rules_privileged_commands_newgrp ++ - audit_rules_privileged_commands_pam_timestamp_check ++ - audit_rules_privileged_commands_passwd ++ - audit_rules_privileged_commands_postdrop ++ - audit_rules_privileged_commands_postqueue ++ - audit_rules_privileged_commands_ssh_keysign ++ - audit_rules_privileged_commands_sudoedit ++ - audit_rules_privileged_commands_umount ++ - audit_rules_privileged_commands_unix_chkpwd ++ - audit_rules_privileged_commands_userhelper ++ - audit_rules_session_events ++ - audit_rules_sysadmin_actions ++ - audit_rules_system_shutdown ++ - audit_rules_time_adjtimex ++ - audit_rules_time_clock_settime ++ - audit_rules_time_settimeofday ++ - audit_rules_time_stime ++ - audit_rules_time_watch_localtime ++ - audit_rules_unsuccessful_file_modification_creat ++ - audit_rules_unsuccessful_file_modification_ftruncate ++ - audit_rules_unsuccessful_file_modification_openat ++ - audit_rules_unsuccessful_file_modification_open_by_handle_at ++ - audit_rules_unsuccessful_file_modification_open ++ - audit_rules_unsuccessful_file_modification_truncate ++ - audit_rules_usergroup_modification_group ++ - audit_rules_usergroup_modification_gshadow ++ - audit_rules_usergroup_modification_opasswd ++ - audit_rules_usergroup_modification_passwd ++ - audit_rules_usergroup_modification_shadow +diff --git a/products/almalinux8/profiles/ism_o.profile b/products/almalinux8/profiles/ism_o.profile +new file mode 100644 +index 00000000..63aa09b3 +--- /dev/null ++++ b/products/almalinux8/profiles/ism_o.profile +@@ -0,0 +1,135 @@ ++documentation_complete: true ++ ++metadata: ++ SMEs: ++ - shaneboulden ++ - wcushen ++ - ahamilto156 ++ ++reference: https://www.cyber.gov.au/ism ++ ++title: 'Australian Cyber Security Centre (ACSC) ISM Official' ++ ++description: |- ++ This profile contains configuration checks for AlmaLinux 8 ++ that align to the Australian Cyber Security Centre (ACSC) Information Security Manual (ISM) ++ with the applicability marking of OFFICIAL. ++ ++ The ISM uses a risk-based approach to cyber security. This profile provides a guide to aligning ++ AlmaLinux security controls with the ISM, which can be used to select controls ++ specific to an organisation's security posture and risk profile. ++ ++ A copy of the ISM can be found at the ACSC website: ++ ++ https://www.cyber.gov.au/ism ++ ++extends: e8 ++ ++selections: ++ ++ ## Operating system configuration ++ ## Identifiers 1491 ++ - no_shelllogin_for_systemaccounts ++ ++ ## Local administrator accounts ++ ## Identifiers 1382 / 1410 ++ - accounts_password_all_shadowed ++ - package_sudo_installed ++ ++ ## Content filtering & Anti virus ++ ## Identifiers 0576 / 1341 / 1034 / 1417 / 1288 ++ - package_aide_installed ++ ++ ## Software firewall ++ ## Identifiers 1416 ++ - configure_firewalld_ports ++ ## Removing due to build error ++ ## - configure_firewalld_rate_limiting ++ - firewalld_sshd_port_enabled ++ - set_firewalld_default_zone ++ ++ ## Endpoint device control software ++ ## Identifiers 1418 ++ - package_usbguard_installed ++ - service_usbguard_enabled ++ - usbguard_allow_hid_and_hub ++ ++ ## Authentication hardening ++ ## Identifiers 1546 / 0974 / 1173 / 1504 / 1505 / 1401 / 1559 / 1560 ++ ## 1561 / 1546 / 0421 / 1557 / 0422 / 1558 / 1403 / 0431 ++ - sshd_max_auth_tries_value=5 ++ - disable_host_auth ++ - require_emergency_target_auth ++ - require_singleuser_auth ++ - sshd_disable_kerb_auth ++ - sshd_set_max_auth_tries ++ ++ ## Password authentication & Protecting credentials ++ ## Identifiers 0421 / 0431 / 0418 / 1402 ++ - var_password_pam_minlen=14 ++ - var_accounts_password_warn_age_login_defs=7 ++ - var_accounts_minimum_age_login_defs=1 ++ - var_accounts_maximum_age_login_defs=60 ++ - accounts_password_warn_age_login_defs ++ - accounts_maximum_age_login_defs ++ - accounts_minimum_age_login_defs ++ - accounts_passwords_pam_faillock_interval ++ - accounts_passwords_pam_faillock_unlock_time ++ - accounts_passwords_pam_faillock_deny ++ - accounts_passwords_pam_faillock_deny_root ++ - accounts_password_pam_minlen ++ ++ ## Centralised logging facility ++ ## Identifiers 1405 / 0988 ++ - rsyslog_cron_logging ++ - rsyslog_files_groupownership ++ - rsyslog_files_ownership ++ - rsyslog_files_permissions ++ - rsyslog_nolisten ++ - rsyslog_remote_loghost ++ - rsyslog_remote_tls ++ - rsyslog_remote_tls_cacert ++ - package_chrony_installed ++ - service_chronyd_enabled ++ - chronyd_or_ntpd_specify_multiple_servers ++ - chronyd_specify_remote_server ++ - service_chronyd_or_ntpd_enabled ++ ++ ## Events to be logged ++ ## Identifiers 0580 / 0584 / 0582 / 0585 / 0586 / 0846 / 0957 ++ - display_login_attempts ++ - sebool_auditadm_exec_content ++ - audit_rules_privileged_commands ++ - audit_rules_session_events ++ - audit_rules_unsuccessful_file_modification ++ - audit_access_failed ++ - audit_access_success ++ ++ ## Web application & Database servers ++ ## Identifiers 1552 / 1277 ++ - openssl_use_strong_entropy ++ ++ ## Network design and configuration ++ ## Identifiers 1055 / 1311 ++ - network_nmcli_permissions ++ - service_snmpd_disabled ++ - snmpd_use_newer_protocol ++ ++ ## Wireless networks ++ ## Identifiers 1315 ++ - wireless_disable_interfaces ++ ++ ## ASD Approved Cryptographic Algorithms ++ ## Identifiers 0471 / 0472 / 0473 / 0474 / 0475 / 0476 / 0477 / ++ ## 0479 / 0480 / 0481 / 0489 / 0497 / 0994 / 0998 / 1001 / 1139 / ++ ## 1372 / 1373 / 1374 / 1375 ++ - enable_fips_mode ++ - var_system_crypto_policy=fips ++ - configure_crypto_policy ++ ++ ## Secure Shell access ++ ## Identifiers 0484 / 1506 / 1449 / 0487 ++ - sshd_allow_only_protocol2 ++ - sshd_enable_warning_banner ++ - sshd_disable_x11_forwarding ++ - file_permissions_sshd_private_key +diff --git a/products/almalinux8/profiles/ospp-mls.profile b/products/almalinux8/profiles/ospp-mls.profile +new file mode 100644 +index 00000000..d1d1b8af +--- /dev/null ++++ b/products/almalinux8/profiles/ospp-mls.profile +@@ -0,0 +1,25 @@ ++documentation_complete: false ++ ++title: 'Protection Profile for General Purpose Operating Systems - MLS Mode' ++ ++description: |- ++ Placeholder to put MLS specific rules ++ ++extends: ospp ++ ++selections: ++ ++ ################################################ ++ ## MUST INSTALL PACKAGES IN MLS MODE ++ #cups ++ #foomatic ++ #ghostscript ++ #ghostscript-fonts ++ #checkpolicy ++ #mcstrans ++ #policycoreutils-newrole ++ #selinux-policy-devel ++ ##xinetd ++ #iproute ++ #iputils ++ #netlabel_tools +diff --git a/products/almalinux8/profiles/ospp.profile b/products/almalinux8/profiles/ospp.profile +new file mode 100644 +index 00000000..ce4ccaf3 +--- /dev/null ++++ b/products/almalinux8/profiles/ospp.profile +@@ -0,0 +1,445 @@ ++documentation_complete: true ++ ++metadata: ++ version: 4.2.1 ++ SMEs: ++ - comps ++ - carlosmmatos ++ - stevegrubb ++ ++reference: https://www.niap-ccevs.org/Profile/PP.cfm ++ ++title: 'Protection Profile for General Purpose Operating Systems' ++ ++description: |- ++ This profile reflects mandatory configuration controls identified in the ++ NIAP Configuration Annex to the Protection Profile for General Purpose ++ Operating Systems (Protection Profile Version 4.2.1). ++ ++ This configuration profile is consistent with CNSSI-1253, which requires ++ U.S. National Security Systems to adhere to certain configuration ++ parameters. Accordingly, this configuration profile is suitable for ++ use in U.S. National Security Systems. ++ ++selections: ++ ++ ####################################################### ++ ### GENERAL REQUIREMENTS ++ ### Things needed to meet OSPP functional requirements. ++ ####################################################### ++ ++ ### Partitioning ++ - mount_option_home_nodev ++ - mount_option_home_nosuid ++ - mount_option_tmp_nodev ++ - mount_option_tmp_noexec ++ - mount_option_tmp_nosuid ++ - partition_for_var_tmp ++ - mount_option_var_tmp_nodev ++ - mount_option_var_tmp_noexec ++ - mount_option_var_tmp_nosuid ++ - mount_option_dev_shm_nodev ++ - mount_option_dev_shm_noexec ++ - mount_option_dev_shm_nosuid ++ - mount_option_nodev_nonroot_local_partitions ++ - mount_option_boot_nodev ++ - mount_option_boot_nosuid ++ - partition_for_home ++ - partition_for_var ++ - mount_option_var_nodev ++ - partition_for_var_log ++ - mount_option_var_log_nodev ++ - mount_option_var_log_nosuid ++ - mount_option_var_log_noexec ++ - partition_for_var_log_audit ++ - mount_option_var_log_audit_nodev ++ - mount_option_var_log_audit_nosuid ++ - mount_option_var_log_audit_noexec ++ ++ ### Services ++ # sshd ++ - sshd_disable_root_login ++ - sshd_enable_strictmodes ++ - disable_host_auth ++ - sshd_disable_empty_passwords ++ - sshd_disable_kerb_auth ++ - sshd_disable_gssapi_auth ++ - var_sshd_set_keepalive=0 ++ - sshd_set_keepalive_0 ++ - sshd_enable_warning_banner ++ - sshd_rekey_limit ++ - var_rekey_limit_size=1G ++ - var_rekey_limit_time=1hour ++ - sshd_use_strong_rng ++ - openssl_use_strong_entropy ++ ++ # Time Server ++ - chronyd_client_only ++ - chronyd_no_chronyc_network ++ ++ ### Network Settings ++ - sysctl_net_ipv6_conf_all_accept_ra ++ - sysctl_net_ipv6_conf_default_accept_ra ++ - sysctl_net_ipv4_conf_all_accept_redirects ++ - sysctl_net_ipv4_conf_default_accept_redirects ++ - sysctl_net_ipv6_conf_all_accept_redirects ++ - sysctl_net_ipv6_conf_default_accept_redirects ++ - sysctl_net_ipv4_conf_all_accept_source_route ++ - sysctl_net_ipv4_conf_default_accept_source_route ++ - sysctl_net_ipv6_conf_all_accept_source_route ++ - sysctl_net_ipv6_conf_default_accept_source_route ++ - sysctl_net_ipv4_conf_all_secure_redirects ++ - sysctl_net_ipv4_conf_default_secure_redirects ++ - sysctl_net_ipv4_conf_all_send_redirects ++ - sysctl_net_ipv4_conf_default_send_redirects ++ - sysctl_net_ipv4_conf_all_log_martians ++ - sysctl_net_ipv4_conf_default_log_martians ++ - sysctl_net_ipv4_conf_all_rp_filter ++ - sysctl_net_ipv4_conf_default_rp_filter ++ - sysctl_net_ipv4_icmp_ignore_bogus_error_responses ++ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts ++ - sysctl_net_ipv4_ip_forward ++ - sysctl_net_ipv4_tcp_syncookies ++ ++ ### systemd ++ - disable_ctrlaltdel_reboot ++ - disable_ctrlaltdel_burstaction ++ - service_debug-shell_disabled ++ ++ ### umask ++ - var_accounts_user_umask=027 ++ - accounts_umask_etc_profile ++ - accounts_umask_etc_bashrc ++ - accounts_umask_etc_csh_cshrc ++ ++ ### Software update ++ - ensure_almalinux_gpgkey_installed ++ - ensure_gpgcheck_globally_activated ++ - ensure_gpgcheck_local_packages ++ - ensure_gpgcheck_never_disabled ++ ++ ### Passwords ++ - var_password_pam_difok=4 ++ - accounts_password_pam_difok ++ - var_password_pam_maxrepeat=3 ++ - accounts_password_pam_maxrepeat ++ - var_password_pam_maxclassrepeat=4 ++ - accounts_password_pam_maxclassrepeat ++ ++ ### Kernel Config ++ ## Boot prompt ++ - grub2_audit_argument ++ - grub2_audit_backlog_limit_argument ++ - grub2_slub_debug_argument ++ - grub2_page_poison_argument ++ - grub2_vsyscall_argument ++ - grub2_vsyscall_argument.role=unscored ++ - grub2_vsyscall_argument.severity=info ++ - grub2_pti_argument ++ - grub2_kernel_trust_cpu_rng ++ ++ ## Security Settings ++ - sysctl_kernel_kptr_restrict ++ - sysctl_kernel_dmesg_restrict ++ - sysctl_kernel_kexec_load_disabled ++ - sysctl_kernel_yama_ptrace_scope ++ - sysctl_kernel_perf_event_paranoid ++ - sysctl_user_max_user_namespaces ++ - sysctl_user_max_user_namespaces.role=unscored ++ - sysctl_user_max_user_namespaces.severity=info ++ - sysctl_kernel_unprivileged_bpf_disabled ++ - sysctl_net_core_bpf_jit_harden ++ - service_kdump_disabled ++ ++ ## File System Settings ++ - sysctl_fs_protected_hardlinks ++ - sysctl_fs_protected_symlinks ++ ++ ### Audit ++ - service_auditd_enabled ++ - var_auditd_flush=incremental_async ++ - auditd_data_retention_flush ++ - auditd_local_events ++ - auditd_write_logs ++ - auditd_log_format ++ - auditd_freq ++ - auditd_name_format ++ ++ ### Module Blacklist ++ - kernel_module_cramfs_disabled ++ - kernel_module_bluetooth_disabled ++ - kernel_module_sctp_disabled ++ - kernel_module_firewire-core_disabled ++ - kernel_module_atm_disabled ++ - kernel_module_can_disabled ++ - kernel_module_tipc_disabled ++ ++ ### rpcbind ++ ++ ### Install Required Packages ++ - package_aide_installed ++ - package_dnf-automatic_installed ++ - package_subscription-manager_installed ++ - package_dnf-plugin-subscription-manager_installed ++ - package_firewalld_installed ++ - package_openscap-scanner_installed ++ - package_policycoreutils_installed ++ - package_sudo_installed ++ - package_usbguard_installed ++ - package_scap-security-guide_installed ++ - package_audit_installed ++ - package_crypto-policies_installed ++ - package_openssh-server_installed ++ - package_openssh-clients_installed ++ - package_policycoreutils-python-utils_installed ++ - package_rsyslog_installed ++ - package_rsyslog-gnutls_installed ++ - package_audispd-plugins_installed ++ - package_chrony_installed ++ - package_gnutls-utils_installed ++ ++ ### Remove Prohibited Packages ++ - package_sendmail_removed ++ - package_iprutils_removed ++ - package_gssproxy_removed ++ - package_nfs-utils_removed ++ - package_krb5-workstation_removed ++ - package_abrt-addon-kerneloops_removed ++ - package_abrt-addon-python_removed ++ - package_abrt-addon-ccpp_removed ++ - package_abrt-plugin-rhtsupport_removed ++ - package_abrt-plugin-logger_removed ++ - package_abrt-plugin-sosreport_removed ++ - package_abrt-cli_removed ++ - package_abrt_removed ++ ++ ### Login ++ - disable_users_coredumps ++ - sysctl_kernel_core_pattern ++ - coredump_disable_storage ++ - coredump_disable_backtraces ++ - service_systemd-coredump_disabled ++ - var_accounts_max_concurrent_login_sessions=10 ++ - accounts_max_concurrent_login_sessions ++ - securetty_root_login_console_only ++ - var_password_pam_unix_remember=5 ++ - accounts_password_pam_unix_remember ++ - use_pam_wheel_for_su ++ ++ ### SELinux Configuration ++ - var_selinux_state=enforcing ++ - selinux_state ++ - var_selinux_policy_name=targeted ++ - selinux_policytype ++ ++ ### Application Whitelisting (RHEL 8) ++ - package_fapolicyd_installed ++ - service_fapolicyd_enabled ++ ++ ### Configure USBGuard ++ - service_usbguard_enabled ++ - configure_usbguard_auditbackend ++ - usbguard_allow_hid_and_hub ++ ++ ++ ### Enable / Configure FIPS ++ - enable_fips_mode ++ - var_system_crypto_policy=fips_ospp ++ - configure_crypto_policy ++ - configure_ssh_crypto_policy ++ - configure_bind_crypto_policy ++ - configure_openssl_crypto_policy ++ - configure_libreswan_crypto_policy ++ - configure_kerberos_crypto_policy ++ - enable_dracut_fips_module ++ ++ ####################################################### ++ ### CONFIGURATION ANNEX TO THE PROTECTION PROFILE ++ ### FOR GENERAL PURPOSE OPERATING SYSTEMS ++ ### ANNEX RELEASE 1 ++ ### FOR PROTECTION PROFILE VERSIONS 4.2 ++ ### ++ ### https://www.niap-ccevs.org/MMO/PP/-442ConfigAnnex-/ ++ ####################################################### ++ ++ ## Configure Minimum Password Length to 12 Characters ++ ## IA-5 (1)(a) / FMT_MOF_EXT.1 ++ - var_accounts_password_minlen_login_defs=12 ++ - accounts_password_minlen_login_defs ++ - var_password_pam_minlen=12 ++ - accounts_password_pam_minlen ++ ++ ## Require at Least 1 Special Character in Password ++ ## IA-5(1)(a) / FMT_MOF_EXT.1 ++ - var_password_pam_ocredit=1 ++ - accounts_password_pam_ocredit ++ ++ ## Require at Least 1 Numeric Character in Password ++ ## IA-5(1)(a) / FMT_MOF_EXT.1 ++ - var_password_pam_dcredit=1 ++ - accounts_password_pam_dcredit ++ ++ ## Require at Least 1 Uppercase Character in Password ++ ## IA-5(1)(a) / FMT_MOF_EXT.1 ++ - var_password_pam_ucredit=1 ++ - accounts_password_pam_ucredit ++ ++ ## Require at Least 1 Lowercase Character in Password ++ ## IA-5(1)(a) / FMT_MOF_EXT.1 ++ - var_password_pam_lcredit=1 ++ - accounts_password_pam_lcredit ++ ++ ## Enable Screen Lock ++ ## FMT_MOF_EXT.1 ++ - package_tmux_installed ++ - configure_bashrc_exec_tmux ++ - no_tmux_in_shells ++ - configure_tmux_lock_command ++ - configure_tmux_lock_after_time ++ ++ ## Set Screen Lock Timeout Period to 30 Minutes or Less ++ ## AC-11(a) / FMT_MOF_EXT.1 ++ ## We deliberately set sshd timeout to 1 minute before tmux lock timeout ++ - sshd_idle_timeout_value=14_minutes ++ - sshd_set_idle_timeout ++ ++ ## Disable Unauthenticated Login (such as Guest Accounts) ++ ## FIA_UAU.1 ++ - require_singleuser_auth ++ - grub2_disable_interactive_boot ++ - grub2_uefi_password ++ - no_empty_passwords ++ ++ ## Set Maximum Number of Authentication Failures to 3 Within 15 Minutes ++ ## AC-7 / FIA_AFL.1 ++ - var_accounts_passwords_pam_faillock_deny=3 ++ - accounts_passwords_pam_faillock_deny ++ - var_accounts_passwords_pam_faillock_fail_interval=900 ++ - accounts_passwords_pam_faillock_interval ++ - var_accounts_passwords_pam_faillock_unlock_time=never ++ - accounts_passwords_pam_faillock_unlock_time ++ ++ ## Enable Host-Based Firewall ++ ## SC-7(12) / FMT_MOF_EXT.1 ++ - service_firewalld_enabled ++ ++ ## Configure Name/Addres of Remote Management Server ++ ## From Which to Receive Config Settings ++ ## CM-3(3) / FMT_MOF_EXT.1 ++ ++ ## Configure the System to Offload Audit Records to a Log ++ ## Server ++ ## AU-4(1) / FAU_GEN.1.1.c ++ # temporarily dropped ++ ++ ## Set Logon Warning Banner ++ ## AC-8(a) / FMT_MOF_EXT.1 ++ ++ ## Audit All Logons (Success/Failure) and Logoffs (Success) ++ ## CNSSI 1253 Value or DoD-Specific Values: ++ ## (1) Logons (Success/Failure) ++ ## (2) Logoffs (Success) ++ ## AU-2(a) / FAU_GEN.1.1.c ++ ++ ## Audit File and Object Events (Unsuccessful) ++ ## CNSSI 1253 Value or DoD-specific Values: ++ ## (1) Create (Success/Failure) ++ ## (2) Access (Success/Failure) ++ ## (3) Delete (Sucess/Failure) ++ ## (4) Modify (Success/Failure) ++ ## (5) Permission Modification (Sucess/Failure) ++ ## (6) Ownership Modification (Success/Failure) ++ ## AU-2(a) / FAU_GEN.1.1.c ++ ## ++ ## ++ ## (1) Create (Success/Failure) ++ ## (open with O_CREAT) ++ ## (2) Access (Success/Failure) ++ ## (3) Delete (Success/Failure) ++ ## (4) Modify (Success/Failure) ++ ## (5) Permission Modification (Success/Failure) ++ ## (6) Ownership Modification (Success/Failure) ++ ++ ## Audit User and Group Management Events (Success/Failure) ++ ## CNSSI 1253 Value or DoD-specific Values: ++ ## (1) User add, delete, modify, disable, enable (Success/Failure) ++ ## (2) Group/Role add, delete, modify (Success/Failure) ++ ## AU-2(a) / FAU_GEN.1.1.c ++ ## ++ ## Generic User and Group Management Events (Success/Failure) ++ ## Selection of setuid programs that relate to ++ ## user accounts. ++ ## ++ ## CNSSI 1253: (1) User add, delete, modify, disable, enable (Success/Failure) ++ ## ++ ## CNSSI 1252: (2) Group/Role add, delete, modify (Success/Failure) ++ ## ++ ## Audit Privilege or Role Escalation Events (Success/Failure) ++ ## CNSSI 1253 Value or DoD-specific Values: ++ ## - Privilege/Role escalation (Success/Failure) ++ ## AU-2(a) / FAU_GEN.1.1.c ++ ## Audit All Audit and Log Data Accesses (Success/Failure) ++ ## CNSSI 1253 Value or DoD-specific Values: ++ ## - Audit and log data access (Success/Failure) ++ ## AU-2(a) / FAU_GEN.1.1.c ++ ## Audit Cryptographic Verification of Software (Success/Failure) ++ ## CNSSI 1253 Value or DoD-specific Values: ++ ## - Applications (e.g. Firefox, Internet Explorer, MS Office Suite, ++ ## etc) initialization (Success/Failure) ++ ## AU-2(a) / FAU_GEN.1.1.c ++ ## Audit Kernel Module Loading and Unloading Events (Success/Failure) ++ ## AU-2(a) / FAU_GEN.1.1.c ++ - audit_basic_configuration ++ - audit_immutable_login_uids ++ - audit_create_failed ++ - audit_create_success ++ - audit_modify_failed ++ - audit_modify_success ++ - audit_access_failed ++ - audit_access_success ++ - audit_delete_failed ++ - audit_delete_success ++ - audit_perm_change_failed ++ - audit_perm_change_success ++ - audit_owner_change_failed ++ - audit_owner_change_success ++ - audit_ospp_general ++ - audit_module_load ++ ++ ## Enable Automatic Software Updates ++ ## SI-2 / FMT_MOF_EXT.1 ++ # Configure dnf-automatic to Install Only Security Updates ++ - dnf-automatic_security_updates_only ++ ++ # Configure dnf-automatic to Install Available Updates Automatically ++ - dnf-automatic_apply_updates ++ ++ # Enable dnf-automatic Timer ++ - timer_dnf-automatic_enabled ++ ++ # Configure TLS for remote logging ++ - rsyslog_remote_tls ++ - rsyslog_remote_tls_cacert ++ ++ # Prevent Kerberos use by system daemons ++ - kerberos_disable_no_keytab ++ ++ # set ssh client rekey limit ++ - ssh_client_rekey_limit ++ - var_ssh_client_rekey_limit_size=1G ++ - var_ssh_client_rekey_limit_time=1hour ++ ++# configure ssh client to use strong entropy ++ - ssh_client_use_strong_rng_sh ++ - ssh_client_use_strong_rng_csh ++ ++ # zIPl specific rules ++ - zipl_bls_entries_only ++ - zipl_bootmap_is_up_to_date ++ - zipl_audit_argument ++ - zipl_audit_backlog_limit_argument ++ - zipl_slub_debug_argument ++ - zipl_page_poison_argument ++ - zipl_vsyscall_argument ++ - zipl_vsyscall_argument.role=unscored ++ - zipl_vsyscall_argument.severity=info +diff --git a/products/almalinux8/profiles/pci-dss.profile b/products/almalinux8/profiles/pci-dss.profile +new file mode 100644 +index 00000000..9faa9b1f +--- /dev/null ++++ b/products/almalinux8/profiles/pci-dss.profile +@@ -0,0 +1,148 @@ ++documentation_complete: true ++ ++metadata: ++ SMEs: ++ - carlosmmatos ++ ++reference: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf ++ ++title: 'PCI-DSS v3.2.1 Control Baseline for AlmaLinux 8' ++ ++description: |- ++ Ensures PCI-DSS v3.2.1 security configuration settings are applied. ++ ++selections: ++ - var_password_pam_unix_remember=4 ++ - var_account_disable_post_pw_expiration=90 ++ - var_accounts_passwords_pam_faillock_deny=6 ++ - var_accounts_passwords_pam_faillock_unlock_time=1800 ++ - sshd_idle_timeout_value=15_minutes ++ - var_password_pam_minlen=7 ++ - var_password_pam_minclass=2 ++ - var_accounts_maximum_age_login_defs=90 ++ - var_auditd_num_logs=5 ++ - service_auditd_enabled ++ - grub2_audit_argument ++ - auditd_data_retention_num_logs ++ - auditd_data_retention_max_log_file ++ - auditd_data_retention_max_log_file_action ++ - auditd_data_retention_space_left_action ++ - auditd_data_retention_admin_space_left_action ++ - auditd_data_retention_action_mail_acct ++ - package_audispd-plugins_installed ++ - auditd_audispd_syslog_plugin_activated ++ - audit_rules_time_adjtimex ++ - audit_rules_time_settimeofday ++ - audit_rules_time_stime ++ - audit_rules_time_clock_settime ++ - audit_rules_time_watch_localtime ++ - audit_rules_usergroup_modification_group ++ - audit_rules_usergroup_modification_gshadow ++ - audit_rules_usergroup_modification_opasswd ++ - audit_rules_usergroup_modification_passwd ++ - audit_rules_usergroup_modification_shadow ++ - audit_rules_networkconfig_modification ++ - file_permissions_var_log_audit ++ - file_ownership_var_log_audit ++ - audit_rules_mac_modification ++ - audit_rules_dac_modification_chmod ++ - audit_rules_dac_modification_chown ++ - audit_rules_dac_modification_fchmod ++ - audit_rules_dac_modification_fchmodat ++ - audit_rules_dac_modification_fchown ++ - audit_rules_dac_modification_fchownat ++ - audit_rules_dac_modification_fremovexattr ++ - audit_rules_dac_modification_fsetxattr ++ - audit_rules_dac_modification_lchown ++ - audit_rules_dac_modification_lremovexattr ++ - audit_rules_dac_modification_lsetxattr ++ - audit_rules_dac_modification_removexattr ++ - audit_rules_dac_modification_setxattr ++ - audit_rules_login_events ++ - audit_rules_session_events ++ - audit_rules_unsuccessful_file_modification_creat ++ - audit_rules_unsuccessful_file_modification_ftruncate ++ - audit_rules_unsuccessful_file_modification_open ++ - audit_rules_unsuccessful_file_modification_open_by_handle_at ++ - audit_rules_unsuccessful_file_modification_openat ++ - audit_rules_unsuccessful_file_modification_truncate ++ - audit_rules_privileged_commands ++ - audit_rules_media_export ++ - audit_rules_file_deletion_events_rename ++ - audit_rules_file_deletion_events_renameat ++ - audit_rules_file_deletion_events_rmdir ++ - audit_rules_file_deletion_events_unlink ++ - audit_rules_file_deletion_events_unlinkat ++ - audit_rules_sysadmin_actions ++ - audit_rules_kernel_module_loading_delete ++ - audit_rules_kernel_module_loading_finit ++ - audit_rules_kernel_module_loading_init ++ - audit_rules_immutable ++ - var_multiple_time_servers=rhel ++ - service_chronyd_or_ntpd_enabled ++ - chronyd_or_ntpd_specify_remote_server ++ - chronyd_or_ntpd_specify_multiple_servers ++ - rpm_verify_permissions ++ - rpm_verify_hashes ++ - install_hids ++ - rsyslog_files_permissions ++ - rsyslog_files_ownership ++ - rsyslog_files_groupownership ++ - ensure_logrotate_activated ++ - package_aide_installed ++ - aide_build_database ++ - aide_periodic_cron_checking ++ - account_unique_name ++ - gid_passwd_group_same ++ - accounts_password_all_shadowed ++ - no_empty_passwords ++ - display_login_attempts ++ - account_disable_post_pw_expiration ++ - accounts_passwords_pam_faillock_deny ++ - accounts_passwords_pam_faillock_unlock_time ++ - dconf_db_up_to_date ++ - dconf_gnome_screensaver_idle_delay ++ - dconf_gnome_screensaver_idle_activation_enabled ++ - dconf_gnome_screensaver_lock_enabled ++ - dconf_gnome_screensaver_mode_blank ++ - sshd_set_idle_timeout ++ - var_sshd_set_keepalive=0 ++ - sshd_set_keepalive_0 ++ - accounts_password_pam_minlen ++ - accounts_password_pam_dcredit ++ - accounts_password_pam_ucredit ++ - accounts_password_pam_lcredit ++ - accounts_password_pam_unix_remember ++ - accounts_maximum_age_login_defs ++ - ensure_almalinux_gpgkey_installed ++ - ensure_gpgcheck_globally_activated ++ - ensure_gpgcheck_never_disabled ++ - security_patches_up_to_date ++ - package_opensc_installed ++ - var_smartcard_drivers=cac ++ - configure_opensc_card_drivers ++ - force_opensc_card_drivers ++ - package_pcsc-lite_installed ++ - service_pcscd_enabled ++ - sssd_enable_smartcards ++ - set_password_hashing_algorithm_systemauth ++ - set_password_hashing_algorithm_logindefs ++ - set_password_hashing_algorithm_libuserconf ++ - file_owner_etc_shadow ++ - file_groupowner_etc_shadow ++ - file_permissions_etc_shadow ++ - file_owner_etc_group ++ - file_groupowner_etc_group ++ - file_permissions_etc_group ++ - file_owner_etc_passwd ++ - file_groupowner_etc_passwd ++ - file_permissions_etc_passwd ++ - file_owner_grub2_cfg ++ - file_groupowner_grub2_cfg ++ - package_libreswan_installed ++ - configure_crypto_policy ++ - configure_bind_crypto_policy ++ - configure_openssl_crypto_policy ++ - configure_libreswan_crypto_policy ++ - configure_ssh_crypto_policy ++ - configure_kerberos_crypto_policy +diff --git a/products/almalinux8/profiles/rht-ccp.profile b/products/almalinux8/profiles/rht-ccp.profile +new file mode 100644 +index 00000000..282e0b0b +--- /dev/null ++++ b/products/almalinux8/profiles/rht-ccp.profile +@@ -0,0 +1,100 @@ ++documentation_complete: false ++ ++title: 'Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)' ++ ++description: |- ++ This profile contains the minimum security relevant ++ configuration settings recommended by Red Hat, Inc for ++ instances deployed by Red Hat Certified Cloud Providers. ++ ++selections: ++ - var_selinux_state=enforcing ++ - var_selinux_policy_name=targeted ++ - file_owner_logfiles_value=root ++ - file_groupowner_logfiles_value=root ++ - sshd_idle_timeout_value=5_minutes ++ - var_accounts_password_minlen_login_defs=6 ++ - var_accounts_minimum_age_login_defs=7 ++ - var_accounts_passwords_pam_faillock_deny=5 ++ - var_accounts_password_warn_age_login_defs=7 ++ - var_password_pam_retry=3 ++ - var_password_pam_dcredit=1 ++ - var_password_pam_ucredit=2 ++ - var_password_pam_ocredit=2 ++ - var_password_pam_lcredit=2 ++ - var_password_pam_difok=3 ++ - var_password_pam_unix_remember=5 ++ - var_accounts_user_umask=077 ++ - login_banner_text=usgcb_default ++ - partition_for_tmp ++ - partition_for_var ++ - partition_for_var_log ++ - partition_for_var_log_audit ++ - selinux_state ++ - selinux_policytype ++ - ensure_almalinux_gpgkey_installed ++ - security_patches_up_to_date ++ - ensure_gpgcheck_globally_activated ++ - ensure_gpgcheck_never_disabled ++ - package_aide_installed ++ - accounts_password_pam_unix_remember ++ - no_shelllogin_for_systemaccounts ++ - no_empty_passwords ++ - accounts_password_all_shadowed ++ - accounts_no_uid_except_zero ++ - accounts_password_minlen_login_defs ++ - accounts_minimum_age_login_defs ++ - accounts_password_warn_age_login_defs ++ - accounts_password_pam_retry ++ - accounts_password_pam_dcredit ++ - accounts_password_pam_ucredit ++ - accounts_password_pam_ocredit ++ - accounts_password_pam_lcredit ++ - accounts_password_pam_difok ++ - accounts_passwords_pam_faillock_deny ++ - set_password_hashing_algorithm_systemauth ++ - set_password_hashing_algorithm_logindefs ++ - set_password_hashing_algorithm_libuserconf ++ - require_singleuser_auth ++ - file_owner_etc_shadow ++ - file_groupowner_etc_shadow ++ - file_permissions_etc_shadow ++ - file_owner_etc_gshadow ++ - file_groupowner_etc_gshadow ++ - file_permissions_etc_gshadow ++ - file_owner_etc_passwd ++ - file_groupowner_etc_passwd ++ - file_permissions_etc_passwd ++ - file_owner_etc_group ++ - file_groupowner_etc_group ++ - file_permissions_etc_group ++ - file_permissions_library_dirs ++ - file_ownership_library_dirs ++ - file_permissions_binary_dirs ++ - file_ownership_binary_dirs ++ - file_permissions_var_log_audit ++ - file_owner_grub2_cfg ++ - file_groupowner_grub2_cfg ++ - file_permissions_grub2_cfg ++ - grub2_password ++ - kernel_module_dccp_disabled ++ - kernel_module_sctp_disabled ++ - service_firewalld_enabled ++ - set_firewalld_default_zone ++ - firewalld_sshd_port_enabled ++ - service_abrtd_disabled ++ - service_telnet_disabled ++ - package_telnet-server_removed ++ - package_telnet_removed ++ - sshd_allow_only_protocol2 ++ - sshd_set_idle_timeout ++ - var_sshd_set_keepalive=0 ++ - sshd_set_keepalive_0 ++ - disable_host_auth ++ - sshd_disable_root_login ++ - sshd_disable_empty_passwords ++ - sshd_enable_warning_banner ++ - sshd_do_not_permit_user_env ++ - var_system_crypto_policy=fips ++ - configure_crypto_policy ++ - configure_ssh_crypto_policy +diff --git a/products/almalinux8/profiles/standard.profile b/products/almalinux8/profiles/standard.profile +new file mode 100644 +index 00000000..7904d13c +--- /dev/null ++++ b/products/almalinux8/profiles/standard.profile +@@ -0,0 +1,67 @@ ++documentation_complete: false ++ ++title: 'Standard System Security Profile for AlmaLinux 8' ++ ++description: |- ++ This profile contains rules to ensure standard security baseline ++ of a AlmaLinux 8 system. Regardless of your system's workload ++ all of these checks should pass. ++ ++selections: ++ - ensure_almalinux_gpgkey_installed ++ - ensure_gpgcheck_globally_activated ++ - rpm_verify_permissions ++ - rpm_verify_hashes ++ - security_patches_up_to_date ++ - no_empty_passwords ++ - file_permissions_unauthorized_sgid ++ - file_permissions_unauthorized_suid ++ - file_permissions_unauthorized_world_writable ++ - accounts_root_path_dirs_no_write ++ - dir_perms_world_writable_sticky_bits ++ - mount_option_dev_shm_nodev ++ - mount_option_dev_shm_nosuid ++ - partition_for_var_log ++ - partition_for_var_log_audit ++ - package_rsyslog_installed ++ - service_rsyslog_enabled ++ - audit_rules_time_adjtimex ++ - audit_rules_time_settimeofday ++ - audit_rules_time_stime ++ - audit_rules_time_clock_settime ++ - audit_rules_time_watch_localtime ++ - audit_rules_usergroup_modification ++ - audit_rules_networkconfig_modification ++ - audit_rules_mac_modification ++ - audit_rules_dac_modification_chmod ++ - audit_rules_dac_modification_chown ++ - audit_rules_dac_modification_fchmod ++ - audit_rules_dac_modification_fchmodat ++ - audit_rules_dac_modification_fchown ++ - audit_rules_dac_modification_fchownat ++ - audit_rules_dac_modification_fremovexattr ++ - audit_rules_dac_modification_fsetxattr ++ - audit_rules_dac_modification_lchown ++ - audit_rules_dac_modification_lremovexattr ++ - audit_rules_dac_modification_lsetxattr ++ - audit_rules_dac_modification_removexattr ++ - audit_rules_dac_modification_setxattr ++ - audit_rules_unsuccessful_file_modification ++ - audit_rules_privileged_commands ++ - audit_rules_media_export ++ - audit_rules_file_deletion_events ++ - audit_rules_sysadmin_actions ++ - audit_rules_kernel_module_loading ++ - service_abrtd_disabled ++ - service_atd_disabled ++ - service_autofs_disabled ++ - service_ntpdate_disabled ++ - service_oddjobd_disabled ++ - service_qpidd_disabled ++ - service_rdisc_disabled ++ - configure_crypto_policy ++ - configure_bind_crypto_policy ++ - configure_openssl_crypto_policy ++ - configure_libreswan_crypto_policy ++ - configure_ssh_crypto_policy ++ - configure_kerberos_crypto_policy +diff --git a/products/almalinux8/profiles/stig.profile b/products/almalinux8/profiles/stig.profile +new file mode 100644 +index 00000000..ec8f3137 +--- /dev/null ++++ b/products/almalinux8/profiles/stig.profile +@@ -0,0 +1,1186 @@ ++documentation_complete: true ++ ++metadata: ++ version: V1R3 ++ SMEs: ++ - ggbecker ++ ++reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux ++ ++title: 'DISA STIG for AlmaLinux 8' ++ ++description: |- ++ This profile contains configuration checks that align to the ++ DISA STIG for AlmaLinux 8 V1R3. ++ ++selections: ++ ### Variables ++ - var_rekey_limit_size=1G ++ - var_rekey_limit_time=1hour ++ - var_accounts_user_umask=077 ++ - var_password_pam_difok=8 ++ - var_password_pam_maxrepeat=3 ++ - var_sshd_disable_compression=no ++ - var_password_hashing_algorithm=SHA512 ++ - var_password_pam_maxclassrepeat=4 ++ - var_password_pam_minclass=4 ++ - var_accounts_minimum_age_login_defs=1 ++ - var_accounts_max_concurrent_login_sessions=10 ++ - var_password_pam_remember=5 ++ - var_password_pam_remember_control_flag=required ++ - var_selinux_state=enforcing ++ - var_selinux_policy_name=targeted ++ - var_accounts_password_minlen_login_defs=15 ++ - var_password_pam_unix_rounds=5000 ++ - var_password_pam_minlen=15 ++ - var_password_pam_ocredit=1 ++ - var_password_pam_dcredit=1 ++ - var_password_pam_dictcheck=1 ++ - var_password_pam_ucredit=1 ++ - var_password_pam_lcredit=1 ++ - var_password_pam_retry=3 ++ - var_password_pam_minlen=15 ++ - var_sshd_set_keepalive=0 ++ - sshd_approved_macs=stig ++ - sshd_approved_ciphers=stig ++ - sshd_idle_timeout_value=10_minutes ++ - var_accounts_authorized_local_users_regex=rhel8 ++ - var_accounts_passwords_pam_faillock_deny=3 ++ - var_accounts_passwords_pam_faillock_fail_interval=900 ++ - var_accounts_passwords_pam_faillock_unlock_time=never ++ - var_ssh_client_rekey_limit_size=1G ++ - var_ssh_client_rekey_limit_time=1hour ++ - var_accounts_fail_delay=4 ++ - var_account_disable_post_pw_expiration=35 ++ - var_auditd_action_mail_acct=root ++ - var_time_service_set_maxpoll=18_hours ++ - var_accounts_maximum_age_login_defs=60 ++ - var_auditd_space_left_percentage=25pc ++ - var_auditd_space_left_action=email ++ - var_auditd_disk_error_action=halt ++ - var_auditd_max_log_file_action=syslog ++ - var_auditd_disk_full_action=halt ++ ++ ### Enable / Configure FIPS ++ - enable_fips_mode ++ - var_system_crypto_policy=fips ++ - configure_crypto_policy ++ - configure_bind_crypto_policy ++ - configure_libreswan_crypto_policy ++ - configure_kerberos_crypto_policy ++ - enable_dracut_fips_module ++ ++ ### Rules: ++ # RHEL-08-010000 ++ - installed_OS_is_vendor_supported ++ ++ # RHEL-08-010001 ++ - package_mcafeetp_installed ++ - agent_mfetpd_running ++ ++ # RHEL-08-010010 ++ - security_patches_up_to_date ++ ++ # RHEL-08-010020 ++ - sysctl_crypto_fips_enabled ++ ++ # RHEL-08-010030 ++ - encrypt_partitions ++ ++ # RHEL-08-010040 ++ - sshd_enable_warning_banner ++ ++ # RHEL-08-010049 ++ - dconf_gnome_banner_enabled ++ ++ # RHEL-08-010050 ++ - dconf_gnome_login_banner_text ++ ++ # RHEL-08-010060 ++ - banner_etc_issue ++ ++ # RHEL-08-010070 ++ - rsyslog_remote_access_monitoring ++ ++ # RHEL-08-010090 ++ ++ # RHEL-08-010100 ++ ++ # RHEL-08-010110 ++ - set_password_hashing_algorithm_logindefs ++ ++ # RHEL-08-010120 ++ - accounts_password_all_shadowed_sha512 ++ ++ # RHEL-08-010130 ++ - accounts_password_pam_unix_rounds_password_auth ++ ++ # RHEL-08-010131 ++ - accounts_password_pam_unix_rounds_system_auth ++ ++ # RHEL-08-010140 ++ - grub2_uefi_password ++ ++ # RHEL-08-010141 ++ - grub2_uefi_admin_username ++ ++ # RHEL-08-010149 ++ - grub2_admin_username ++ ++ # RHEL-08-010150 ++ - grub2_password ++ ++ # RHEL-08-010151 ++ - require_singleuser_auth ++ ++ # RHEL-08-010152 ++ - require_emergency_target_auth ++ ++ # RHEL-08-010160 ++ - set_password_hashing_algorithm_systemauth ++ ++ # RHEL-08-010161 ++ - kerberos_disable_no_keytab ++ ++ # RHEL-08-010162 ++ - package_krb5-workstation_removed ++ ++ # RHEL-08-010170 ++ - selinux_state ++ ++ # RHEL-08-010171 ++ - package_policycoreutils_installed ++ ++ # RHEL-08-010180 ++ ++ # RHEL-08-010190 ++ - dir_perms_world_writable_sticky_bits ++ ++ # RHEL-08-010200 ++ - sshd_set_keepalive_0 ++ ++ # RHEL-08-010201 ++ - sshd_set_idle_timeout ++ ++ # RHEL-08-010210 ++ - file_permissions_var_log_messages ++ ++ # RHEL-08-010220 ++ - file_owner_var_log_messages ++ ++ # RHEL-08-010230 ++ - file_groupowner_var_log_messages ++ ++ # RHEL-08-010240 ++ - file_permissions_var_log ++ ++ # RHEL-08-010250 ++ - file_owner_var_log ++ ++ # RHEL-08-010260 ++ - file_groupowner_var_log ++ ++ # *** SHARED *** # ++ # RHEL-08-010290 && RHEL-08-010291 ++ # *** SHARED *** # ++ - configure_ssh_crypto_policy ++ ++ # RHEL-08-010290 ++ - harden_sshd_macs_openssh_conf_crypto_policy ++ - harden_sshd_macs_opensshserver_conf_crypto_policy ++ ++ # RHEL-08-010291 ++ - harden_sshd_ciphers_openssh_conf_crypto_policy ++ - harden_sshd_ciphers_opensshserver_conf_crypto_policy ++ ++ # RHEL-08-010292 ++ - sshd_use_strong_rng ++ ++ # RHEL-08-010293 ++ - configure_openssl_crypto_policy ++ ++ # RHEL-08-010294 ++ - configure_openssl_tls_crypto_policy ++ ++ # RHEL-08-010295 ++ - configure_gnutls_tls_crypto_policy ++ ++ # RHEL-08-010300 ++ - file_permissions_binary_dirs ++ ++ # RHEL-08-010310 ++ - file_ownership_binary_dirs ++ ++ # RHEL-08-010320 ++ - file_groupownership_system_commands_dirs ++ ++ # RHEL-08-010330 ++ - file_permissions_library_dirs ++ ++ # RHEL-08-010340 ++ - file_ownership_library_dirs ++ ++ # RHEL-08-010350 ++ - root_permissions_syslibrary_files ++ - dir_group_ownership_library_dirs ++ ++ # RHEL-08-010360 ++ - package_aide_installed ++ - aide_scan_notification ++ ++ # RHEL-08-010370 ++ - ensure_gpgcheck_globally_activated ++ ++ # RHEL-08-010371 ++ - ensure_gpgcheck_local_packages ++ ++ # RHEL-08-010372 ++ - sysctl_kernel_kexec_load_disabled ++ ++ # RHEL-08-010373 ++ - sysctl_fs_protected_symlinks ++ ++ # RHEL-08-010374 ++ - sysctl_fs_protected_hardlinks ++ ++ # RHEL-08-010375 ++ - sysctl_kernel_dmesg_restrict ++ ++ # RHEL-08-010376 ++ - sysctl_kernel_perf_event_paranoid ++ ++ # RHEL-08-010380 ++ - sudo_remove_nopasswd ++ ++ # RHEL-08-010381 ++ - sudo_remove_no_authenticate ++ ++ # RHEL-08-010382 ++ - sudo_restrict_privilege_elevation_to_authorized ++ ++ # RHEL-08-010383 ++ - sudoers_validate_passwd ++ ++ # RHEL-08-010384 ++ - sudo_require_reauthentication ++ - var_sudo_timestamp_timeout=always_prompt ++ ++ # RHEL-08-010390 ++ - install_smartcard_packages ++ ++ # RHEL-08-010400 ++ ++ # RHEL-08-010410 ++ - package_opensc_installed ++ ++ # RHEL-08-010420 ++ - bios_enable_execution_restrictions ++ ++ # RHEL-08-010421 ++ - grub2_page_poison_argument ++ ++ # RHEL-08-010422 ++ - grub2_vsyscall_argument ++ ++ # RHEL-08-010423 ++ - grub2_slub_debug_argument ++ ++ # RHEL-08-010430 ++ - sysctl_kernel_randomize_va_space ++ ++ # RHEL-08-010440 ++ - clean_components_post_updating ++ ++ # RHEL-08-010450 ++ - selinux_policytype ++ ++ # RHEL-08-010460 ++ - no_host_based_files ++ ++ # RHEL-08-010470 ++ - no_user_host_based_files ++ ++ # RHEL-08-010471 ++ - service_rngd_enabled ++ ++ # RHEL-08-010472 ++ - package_rng-tools_installed ++ ++ # RHEL-08-010480 ++ - file_permissions_sshd_pub_key ++ ++ # RHEL-08-010490 ++ - file_permissions_sshd_private_key ++ ++ # RHEL-08-010500 ++ - sshd_enable_strictmodes ++ ++ # RHEL-08-010510 ++ - sshd_disable_compression ++ ++ # RHEL-08-010520 ++ - sshd_disable_user_known_hosts ++ ++ # RHEL-08-010521 ++ - sshd_disable_kerb_auth ++ ++ # RHEL-08-010522 ++ - sshd_disable_gssapi_auth ++ ++ # RHEL-08-010540 ++ - partition_for_var ++ ++ # RHEL-08-010541 ++ - partition_for_var_log ++ ++ # RHEL-08-010542 ++ - partition_for_var_log_audit ++ ++ # RHEL-08-010543 ++ - partition_for_tmp ++ ++ # RHEL-08-010544 ++ ### NOTE: Will probably show up in V1R3 - Q3 of 21' ++ - partition_for_var_tmp ++ ++ # RHEL-08-010550 ++ - sshd_disable_root_login ++ ++ # RHEL-08-010560 ++ - service_auditd_enabled ++ ++ # RHEL-08-010561 ++ - service_rsyslog_enabled ++ ++ # RHEL-08-010570 ++ - mount_option_home_nosuid ++ ++ # RHEL-08-010571 ++ - mount_option_boot_nosuid ++ ++ # RHEL-08-010580 ++ - mount_option_nodev_nonroot_local_partitions ++ ++ # RHEL-08-010590 ++ - mount_option_home_noexec ++ ++ # RHEL-08-010600 ++ - mount_option_nodev_removable_partitions ++ ++ # RHEL-08-010610 ++ - mount_option_noexec_removable_partitions ++ ++ # RHEL-08-010620 ++ - mount_option_nosuid_removable_partitions ++ ++ # RHEL-08-010630 ++ - mount_option_noexec_remote_filesystems ++ ++ # RHEL-08-010640 ++ - mount_option_nodev_remote_filesystems ++ ++ # RHEL-08-010650 ++ - mount_option_nosuid_remote_filesystems ++ ++ # RHEL-08-010660 ++ - accounts_user_dot_no_world_writable_programs ++ ++ # RHEL-08-010670 ++ - service_kdump_disabled ++ ++ # RHEL-08-010671 ++ - sysctl_kernel_core_pattern ++ ++ # RHEL-08-010672 ++ - service_systemd-coredump_disabled ++ ++ # RHEL-08-010673 ++ - disable_users_coredumps ++ ++ # RHEL-08-010674 ++ - coredump_disable_storage ++ ++ # RHEL-08-010675 ++ - coredump_disable_backtraces ++ ++ # RHEL-08-010680 ++ - network_configure_name_resolution ++ ++ # RHEL-08-010690 ++ - accounts_user_home_paths_only ++ ++ # RHEL-08-010700 ++ - dir_perms_world_writable_root_owned ++ ++ # RHEL-08-010710 ++ ++ # RHEL-08-010720 ++ - accounts_user_interactive_home_directory_defined ++ ++ # RHEL-08-010730 ++ - file_permissions_home_directories ++ ++ # RHEL-08-010740 ++ - file_groupownership_home_directories ++ ++ # RHEL-08-010750 ++ - accounts_user_interactive_home_directory_exists ++ ++ # RHEL-08-010760 ++ - accounts_have_homedir_login_defs ++ ++ # RHEL-08-010770 ++ - file_permission_user_init_files ++ ++ # RHEL-08-010780 ++ - no_files_unowned_by_user ++ ++ # RHEL-08-010790 ++ - file_permissions_ungroupowned ++ ++ # RHEL-08-010800 ++ - partition_for_home ++ ++ # RHEL-08-010820 ++ - gnome_gdm_disable_automatic_login ++ ++ # RHEL-08-010830 ++ - sshd_do_not_permit_user_env ++ ++ # RHEL-08-020000 ++ - account_temp_expire_date ++ ++ # RHEL-08-020010 ++ - accounts_passwords_pam_faillock_deny ++ ++ # RHEL-08-020011 ++ ++ # RHEL-08-020012 ++ - accounts_passwords_pam_faillock_interval ++ ++ # RHEL-08-020013 ++ ++ # RHEL-08-020014 ++ - accounts_passwords_pam_faillock_unlock_time ++ ++ # RHEL-08-020015 ++ ++ # RHEL-08-020016 ++ ++ # RHEL-08-020017 ++ ++ # RHEL-08-020018 ++ ++ # RHEL-08-020019 ++ ++ # RHEL-08-020020 ++ ++ # RHEL-08-020021 ++ ++ # RHEL-08-020022 ++ - accounts_passwords_pam_faillock_deny_root ++ ++ # RHEL-08-020023 ++ ++ # RHEL-08-020024 ++ - accounts_max_concurrent_login_sessions ++ ++ # RHEL-08-020030 ++ - dconf_gnome_screensaver_lock_enabled ++ ++ # RHEL-08-020039 ++ - package_tmux_installed ++ ++ # RHEL-08-020040 ++ - configure_tmux_lock_command ++ ++ # RHEL-08-020041 ++ - configure_bashrc_exec_tmux ++ ++ # RHEL-08-020042 ++ - no_tmux_in_shells ++ ++ # RHEL-08-020050 ++ - dconf_gnome_lock_screen_on_smartcard_removal ++ ++ # RHEL-08-020060 ++ - dconf_gnome_screensaver_idle_delay ++ ++ # RHEL-08-020070 ++ - configure_tmux_lock_after_time ++ ++ # RHEL-08-020080 ++ ++ # RHEL-08-020090 ++ - sssd_enable_certmap ++ ++ # RHEL-08-020100 ++ - accounts_password_pam_retry ++ ++ # RHEL-08-020110 ++ - accounts_password_pam_ucredit ++ ++ # RHEL-08-020120 ++ - accounts_password_pam_lcredit ++ ++ # RHEL-08-020130 ++ - accounts_password_pam_dcredit ++ ++ # RHEL-08-020140 ++ - accounts_password_pam_maxclassrepeat ++ ++ # RHEL-08-020150 ++ - accounts_password_pam_maxrepeat ++ ++ # RHEL-08-020160 ++ - accounts_password_pam_minclass ++ ++ # RHEL-08-020170 ++ - accounts_password_pam_difok ++ ++ # RHEL-08-020180 ++ - accounts_password_set_min_life_existing ++ ++ # RHEL-08-020190 ++ - accounts_minimum_age_login_defs ++ ++ # RHEL-08-020200 ++ - accounts_maximum_age_login_defs ++ ++ # RHEL-08-020210 ++ - accounts_password_set_max_life_existing ++ ++ # RHEL-08-020220 ++ - accounts_password_pam_pwhistory_remember_system_auth ++ - accounts_password_pam_pwhistory_remember_password_auth ++ ++ # RHEL-08-020230 ++ - accounts_password_pam_minlen ++ ++ # RHEL-08-020231 ++ - accounts_password_minlen_login_defs ++ ++ # RHEL-08-020240 ++ - account_unique_id ++ ++ # RHEL-08-020250 ++ - sssd_enable_smartcards ++ ++ # RHEL-08-020260 ++ - account_disable_post_pw_expiration ++ ++ # RHEL-08-020270 ++ - account_emergency_expire_date ++ ++ # RHEL-08-020280 ++ - accounts_password_pam_ocredit ++ ++ # RHEL-08-020290 ++ - sssd_offline_cred_expiration ++ ++ # RHEL-08-020300 ++ - accounts_password_pam_dictcheck ++ ++ # RHEL-08-020310 ++ - accounts_logon_fail_delay ++ ++ # RHEL-08-020320 ++ - accounts_authorized_local_users ++ ++ # RHEL-08-020330 ++ - sshd_disable_empty_passwords ++ ++ # RHEL-08-020331 ++ - no_empty_passwords ++ ++ # RHEL-08-020332 ++ ++ # RHEL-08-020340 ++ - display_login_attempts ++ ++ # RHEL-08-020350 ++ - sshd_print_last_log ++ ++ # RHEL-08-020351 ++ - accounts_umask_etc_login_defs ++ ++ # RHEL-08-020352 ++ - accounts_umask_interactive_users ++ ++ # RHEL-08-020353 ++ - accounts_umask_etc_bashrc ++ ++ # RHEL-08-030000 ++ - audit_rules_suid_privilege_function ++ ++ # RHEL-08-030010 ++ - rsyslog_cron_logging ++ ++ # RHEL-08-030020 ++ - auditd_data_retention_action_mail_acct ++ ++ # RHEL-08-030030 ++ - postfix_client_configure_mail_alias ++ ++ # RHEL-08-030040 ++ - auditd_data_disk_error_action ++ ++ # RHEL-08-030050 ++ - auditd_data_retention_max_log_file_action ++ ++ # RHEL-08-030060 ++ - auditd_data_disk_full_action ++ ++ # RHEL-08-030061 ++ - auditd_local_events ++ ++ # RHEL-08-030062 ++ - auditd_name_format ++ ++ # RHEL-08-030063 ++ - auditd_log_format ++ ++ # RHEL-08-030070 ++ - file_permissions_var_log_audit ++ ++ # RHEL-08-030080 ++ - file_ownership_var_log_audit_stig ++ ++ # RHEL-08-030090 ++ - file_group_ownership_var_log_audit ++ ++ # RHEL-08-030100 ++ - directory_ownership_var_log_audit ++ ++ # RHEL-08-030110 ++ - directory_group_ownership_var_log_audit ++ ++ # RHEL-08-030120 ++ - directory_permissions_var_log_audit ++ ++ # *** NOTE *** # ++ # Audit rules are currently under review as to how best to approach ++ # them. We are working with DISA and our internal audit experts to ++ # provide a final solution soon. ++ # ************ # ++ ++ # RHEL-08-030121 ++ - audit_rules_immutable ++ ++ # RHEL-08-030122 ++ - audit_immutable_login_uids ++ ++ # RHEL-08-030130 ++ - audit_rules_usergroup_modification_shadow ++ ++ # RHEL-08-030140 ++ - audit_rules_usergroup_modification_opasswd ++ ++ # RHEL-08-030150 ++ - audit_rules_usergroup_modification_passwd ++ ++ # RHEL-08-030160 ++ - audit_rules_usergroup_modification_gshadow ++ ++ # RHEL-08-030170 ++ - audit_rules_usergroup_modification_group ++ ++ # RHEL-08-030171 ++ - audit_rules_sudoers ++ ++ # RHEL-08-030172 ++ - audit_rules_sudoers_d ++ ++ # RHEL-08-030180 ++ - package_audit_installed ++ ++ # RHEL-08-030181 ++ - service_auditd_enabled ++ ++ # RHEL-08-030190 ++ - audit_rules_privileged_commands_su ++ ++ # RHEL-08-030200 ++ - audit_rules_dac_modification_lremovexattr ++ ++ # RHEL-08-030210 ++ - audit_rules_dac_modification_removexattr ++ ++ # RHEL-08-030220 ++ - audit_rules_dac_modification_lsetxattr ++ ++ # RHEL-08-030230 ++ - audit_rules_dac_modification_fsetxattr ++ ++ # RHEL-08-030240 ++ - audit_rules_dac_modification_fremovexattr ++ ++ # RHEL-08-030250 ++ - audit_rules_privileged_commands_chage ++ ++ # RHEL-08-030260 ++ - audit_rules_execution_chcon ++ ++ # RHEL-08-030270 ++ - audit_rules_dac_modification_setxattr ++ ++ # RHEL-08-030280 ++ - audit_rules_privileged_commands_ssh_agent ++ ++ # RHEL-08-030290 ++ - audit_rules_privileged_commands_passwd ++ ++ # RHEL-08-030300 ++ - audit_rules_privileged_commands_mount ++ ++ # RHEL-08-030301 ++ - audit_rules_privileged_commands_umount ++ ++ # RHEL-08-030302 ++ - audit_rules_media_export ++ ++ # RHEL-08-030310 ++ - audit_rules_privileged_commands_unix_update ++ ++ # RHEL-08-030311 ++ - audit_rules_privileged_commands_postdrop ++ ++ # RHEL-08-030312 ++ - audit_rules_privileged_commands_postqueue ++ ++ # RHEL-08-030313 ++ - audit_rules_execution_semanage ++ ++ # RHEL-08-030314 ++ - audit_rules_execution_setfiles ++ ++ # RHEL-08-030315 ++ - audit_rules_privileged_commands_userhelper ++ ++ # RHEL-08-030316 ++ - audit_rules_execution_setsebool ++ ++ # RHEL-08-030317 ++ - audit_rules_privileged_commands_unix_chkpwd ++ ++ # RHEL-08-030320 ++ - audit_rules_privileged_commands_ssh_keysign ++ ++ # RHEL-08-030330 ++ - audit_rules_execution_setfacl ++ ++ # RHEL-08-030340 ++ - audit_rules_privileged_commands_pam_timestamp_check ++ ++ # RHEL-08-030350 ++ - audit_rules_privileged_commands_newgrp ++ ++ # RHEL-08-030360 ++ - audit_rules_kernel_module_loading_init ++ ++ # RHEL-08-030361 ++ - audit_rules_file_deletion_events_rename ++ ++ # RHEL-08-030362 ++ - audit_rules_file_deletion_events_renameat ++ ++ # RHEL-08-030363 ++ - audit_rules_file_deletion_events_rmdir ++ ++ # RHEL-08-030364 ++ - audit_rules_file_deletion_events_unlink ++ ++ # RHEL-08-030365 ++ - audit_rules_file_deletion_events_unlinkat ++ ++ # RHEL-08-030370 ++ - audit_rules_privileged_commands_gpasswd ++ ++ # RHEL-08-030380 ++ - audit_rules_kernel_module_loading_finit ++ ++ # RHEL-08-030390 ++ - audit_rules_kernel_module_loading_delete ++ ++ # RHEL-08-030400 ++ - audit_rules_privileged_commands_crontab ++ ++ # RHEL-08-030410 ++ - audit_rules_privileged_commands_chsh ++ ++ # RHEL-08-030420 ++ - audit_rules_unsuccessful_file_modification_truncate ++ ++ # RHEL-08-030430 ++ - audit_rules_unsuccessful_file_modification_openat ++ ++ # RHEL-08-030440 ++ - audit_rules_unsuccessful_file_modification_open ++ ++ # RHEL-08-030450 ++ - audit_rules_unsuccessful_file_modification_open_by_handle_at ++ ++ # RHEL-08-030460 ++ - audit_rules_unsuccessful_file_modification_ftruncate ++ ++ # RHEL-08-030470 ++ - audit_rules_unsuccessful_file_modification_creat ++ ++ # RHEL-08-030480 ++ - audit_rules_dac_modification_chown ++ ++ # RHEL-08-030490 ++ - audit_rules_dac_modification_chmod ++ ++ # RHEL-08-030500 ++ - audit_rules_dac_modification_lchown ++ ++ # RHEL-08-030510 ++ - audit_rules_dac_modification_fchownat ++ ++ # RHEL-08-030520 ++ - audit_rules_dac_modification_fchown ++ ++ # RHEL-08-030530 ++ - audit_rules_dac_modification_fchmodat ++ ++ # RHEL-08-030540 ++ - audit_rules_dac_modification_fchmod ++ ++ # RHEL-08-030550 ++ - audit_rules_privileged_commands_sudo ++ ++ # RHEL-08-030560 ++ - audit_rules_privileged_commands_usermod ++ ++ # RHEL-08-030570 ++ - audit_rules_execution_chacl ++ ++ # RHEL-08-030580 ++ - audit_rules_privileged_commands_kmod ++ ++ # RHEL-08-030590 ++ # This one needs to be updated to use /var/log/faillock, but first RHEL-08-020017 should be ++ # implemented as it is the one that configures a different path for the events of failing locks ++ # - audit_rules_login_events_faillock ++ ++ # RHEL-08-030600 ++ - audit_rules_login_events_lastlog ++ ++ # RHEL-08-030601 ++ - grub2_audit_argument ++ ++ # RHEL-08-030602 ++ - grub2_audit_backlog_limit_argument ++ ++ # RHEL-08-030603 ++ - configure_usbguard_auditbackend ++ ++ # RHEL-08-030610 ++ - file_permissions_etc_audit_auditd ++ - file_permissions_etc_audit_rulesd ++ ++ # RHEL-08-030620 ++ ++ # RHEL-08-030630 ++ ++ # RHEL-08-030640 ++ ++ # RHEL-08-030650 ++ - aide_check_audit_tools ++ ++ # RHEL-08-030660 ++ - auditd_audispd_configure_sufficiently_large_partition ++ ++ # RHEL-08-030670 ++ - package_rsyslog_installed ++ ++ # RHEL-08-030680 ++ - package_rsyslog-gnutls_installed ++ ++ # RHEL-08-030690 ++ - rsyslog_remote_loghost ++ ++ # RHEL-08-030700 ++ - auditd_overflow_action ++ ++ # RHEL-08-030710 ++ - rsyslog_encrypt_offload_defaultnetstreamdriver ++ - rsyslog_encrypt_offload_actionsendstreamdrivermode ++ ++ # RHEL-08-030720 ++ - rsyslog_encrypt_offload_actionsendstreamdriverauthmode ++ ++ # RHEL-08-030730 ++ - auditd_data_retention_space_left_percentage ++ ++ # RHEL-08-030731 ++ - auditd_data_retention_space_left_action ++ ++ # RHEL-08-030740 ++ # remediation fails because default configuration file contains pool instead of server keyword ++ - chronyd_or_ntpd_set_maxpoll ++ ++ # RHEL-08-030741 ++ - chronyd_client_only ++ ++ # RHEL-08-030742 ++ - chronyd_no_chronyc_network ++ ++ # RHEL-08-040000 ++ - package_telnet-server_removed ++ ++ # RHEL-08-040001 ++ - package_abrt_removed ++ - package_abrt-addon-ccpp_removed ++ - package_abrt-addon-kerneloops_removed ++ - package_abrt-addon-python_removed ++ - package_abrt-cli_removed ++ - package_abrt-plugin-logger_removed ++ - package_abrt-plugin-rhtsupport_removed ++ - package_abrt-plugin-sosreport_removed ++ ++ # RHEL-08-040002 ++ - package_sendmail_removed ++ ++ # RHEL-08-040003 ++ ### NOTE: Will be removed in V1R2, merged into RHEL-08-040370 ++ ++ # RHEL-08-040004 ++ - grub2_pti_argument ++ ++ # RHEL-08-040010 ++ - package_rsh-server_removed ++ ++ # RHEL-08-040020 ++ ++ # RHEL-08-040021 ++ - kernel_module_atm_disabled ++ ++ # RHEL-08-040022 ++ - kernel_module_can_disabled ++ ++ # RHEL-08-040023 ++ - kernel_module_sctp_disabled ++ ++ # RHEL-08-040024 ++ - kernel_module_tipc_disabled ++ ++ # RHEL-08-040025 ++ - kernel_module_cramfs_disabled ++ ++ # RHEL-08-040026 ++ - kernel_module_firewire-core_disabled ++ ++ # RHEL-08-040030 ++ - configure_firewalld_ports ++ ++ # RHEL-08-040060 ++ ### NOTE: Will be removed in V1R2 ++ ++ # RHEL-08-040070 ++ - service_autofs_disabled ++ ++ # RHEL-08-040080 ++ - kernel_module_usb-storage_disabled ++ ++ # RHEL-08-040090 ++ ++ # RHEL-08-040100 ++ - package_firewalld_installed ++ ++ # RHEL-08-040101 ++ - service_firewalld_enabled ++ ++ # RHEL-08-040110 ++ - wireless_disable_interfaces ++ ++ # RHEL-08-040111 ++ - kernel_module_bluetooth_disabled ++ ++ # RHEL-08-040120 ++ - mount_option_dev_shm_nodev ++ ++ # RHEL-08-040121 ++ - mount_option_dev_shm_nosuid ++ ++ # RHEL-08-040122 ++ - mount_option_dev_shm_noexec ++ ++ # RHEL-08-040123 ++ - mount_option_tmp_nodev ++ ++ # RHEL-08-040124 ++ - mount_option_tmp_nosuid ++ ++ # RHEL-08-040125 ++ - mount_option_tmp_noexec ++ ++ # RHEL-08-040126 ++ - mount_option_var_log_nodev ++ ++ # RHEL-08-040127 ++ - mount_option_var_log_nosuid ++ ++ # RHEL-08-040128 ++ - mount_option_var_log_noexec ++ ++ # RHEL-08-040129 ++ - mount_option_var_log_audit_nodev ++ ++ # RHEL-08-040130 ++ - mount_option_var_log_audit_nosuid ++ ++ # RHEL-08-040131 ++ - mount_option_var_log_audit_noexec ++ ++ # RHEL-08-040132 ++ - mount_option_var_tmp_nodev ++ ++ # RHEL-08-040133 ++ - mount_option_var_tmp_nosuid ++ ++ # RHEL-08-040134 ++ - mount_option_var_tmp_noexec ++ ++ # RHEL-08-040135 ++ - package_fapolicyd_installed ++ ++ # RHEL-08-040136 ++ - service_fapolicyd_enabled ++ ++ # RHEL-08-040139 ++ - package_usbguard_installed ++ ++ # RHEL-08-040140 ++ - usbguard_generate_policy ++ ++ # RHEL-08-040141 ++ - service_usbguard_enabled ++ ++ # RHEL-08-040150 ++ ++ # RHEL-08-040159 ++ - package_openssh-server_installed ++ ++ # RHEL-08-040160 ++ - service_sshd_enabled ++ ++ # RHEL-08-040161 ++ - sshd_rekey_limit ++ ++ # RHEL-08-040170 ++ - disable_ctrlaltdel_reboot ++ ++ # RHEL-08-040171 ++ - dconf_gnome_disable_ctrlaltdel_reboot ++ ++ # RHEL-08-040172 ++ - disable_ctrlaltdel_burstaction ++ ++ # RHEL-08-040180 ++ - service_debug-shell_disabled ++ ++ # RHEL-08-040190 ++ - package_tftp-server_removed ++ ++ # RHEL-08-040200 ++ - accounts_no_uid_except_zero ++ ++ # RHEL-08-040209 ++ - sysctl_net_ipv4_conf_default_accept_redirects ++ ++ # RHEL-08-040210 ++ - sysctl_net_ipv6_conf_default_accept_redirects ++ ++ # RHEL-08-040220 ++ - sysctl_net_ipv4_conf_all_send_redirects ++ ++ # RHEL-08-040230 ++ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts ++ ++ # RHEL-08-040239 ++ - sysctl_net_ipv4_conf_all_accept_source_route ++ ++ # RHEL-08-040240 ++ - sysctl_net_ipv6_conf_all_accept_source_route ++ ++ # RHEL-08-040249 ++ - sysctl_net_ipv4_conf_default_accept_source_route ++ ++ # RHEL-08-040250 ++ - sysctl_net_ipv6_conf_default_accept_source_route ++ ++ # RHEL-08-040260 ++ - sysctl_net_ipv4_ip_forward ++ ++ # RHEL-08-040261 ++ - sysctl_net_ipv6_conf_all_accept_ra ++ ++ # RHEL-08-040262 ++ - sysctl_net_ipv6_conf_default_accept_ra ++ ++ # RHEL-08-040270 ++ - sysctl_net_ipv4_conf_default_send_redirects ++ ++ # RHEL-08-040279 ++ - sysctl_net_ipv4_conf_all_accept_redirects ++ ++ # RHEL-08-040280 ++ - sysctl_net_ipv6_conf_all_accept_redirects ++ ++ # RHEL-08-040281 ++ - sysctl_kernel_unprivileged_bpf_disabled ++ ++ # RHEL-08-040282 ++ - sysctl_kernel_yama_ptrace_scope ++ ++ # RHEL-08-040283 ++ - sysctl_kernel_kptr_restrict ++ ++ # RHEL-08-040284 ++ - sysctl_user_max_user_namespaces ++ ++ # RHEL-08-040285 ++ - sysctl_net_ipv4_conf_all_rp_filter ++ ++ # RHEL-08-040286 ++ - sysctl_net_core_bpf_jit_harden ++ ++ # RHEL-08-040290 ++ # /etc/postfix/main.cf does not exist on default installation resulting in error during remediation ++ # there needs to be a new platform check to identify when postfix is installed or not ++ # - postfix_prevent_unrestricted_relay ++ ++ # RHEL-08-040300 ++ - aide_verify_ext_attributes ++ ++ # RHEL-08-040310 ++ - aide_verify_acls ++ ++ # RHEL-08-040320 ++ - xwindows_remove_packages ++ ++ # RHEL-08-040330 ++ - network_sniffer_disabled ++ ++ # RHEL-08-040340 ++ - sshd_disable_x11_forwarding ++ ++ # RHEL-08-040341 ++ - sshd_x11_use_localhost ++ ++ # RHEL-08-040350 ++ - tftpd_uses_secure_mode ++ ++ # RHEL-08-040360 ++ - package_vsftpd_removed ++ ++ # RHEL-08-040370 ++ - package_gssproxy_removed ++ ++ # RHEL-08-040380 ++ - package_iprutils_removed ++ ++ # RHEL-08-040390 ++ - package_tuned_removed +diff --git a/products/almalinux8/profiles/stig_gui.profile b/products/almalinux8/profiles/stig_gui.profile +new file mode 100644 +index 00000000..e5d85108 +--- /dev/null ++++ b/products/almalinux8/profiles/stig_gui.profile +@@ -0,0 +1,26 @@ ++documentation_complete: true ++ ++metadata: ++ version: V1R3 ++ SMEs: ++ - ggbecker ++ ++reference: https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cunix-linux ++ ++title: 'DISA STIG with GUI for AlmaLinux 8' ++ ++description: |- ++ This profile contains configuration checks that align to the ++ DISA STIG with GUI for AlmaLinux 8 V1R3. ++ ++ Warning: The installation and use of a Graphical User Interface (GUI) ++ increases your attack vector and decreases your overall security posture. If ++ your Information Systems Security Officer (ISSO) lacks a documented operational ++ requirement for a graphical user interface, please consider using the ++ standard DISA STIG for AlmaLinux 8 profile. ++ ++extends: stig ++ ++selections: ++ # RHEL-08-040320 ++ - '!xwindows_remove_packages' +diff --git a/products/almalinux8/transforms/cci2html.xsl b/products/almalinux8/transforms/cci2html.xsl +new file mode 100644 +index 00000000..f5e327b3 +--- /dev/null ++++ b/products/almalinux8/transforms/cci2html.xsl +@@ -0,0 +1,6 @@ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/constants.xslt b/products/almalinux8/transforms/constants.xslt +new file mode 100644 +index 00000000..7a98cad6 +--- /dev/null ++++ b/products/almalinux8/transforms/constants.xslt +@@ -0,0 +1,21 @@ ++ ++ ++ ++ ++AlmaLinux 8 ++AL8 ++AL_8_STIG ++almalinux8 ++ ++empty ++AL-8 ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/shorthand2xccdf.xslt b/products/almalinux8/transforms/shorthand2xccdf.xslt +new file mode 100644 +index 00000000..4b191e90 +--- /dev/null ++++ b/products/almalinux8/transforms/shorthand2xccdf.xslt +@@ -0,0 +1,8 @@ ++ ++ ++ ++ ++ ++unknown ++ ++ +diff --git a/products/almalinux8/transforms/table-add-srgitems.xslt b/products/almalinux8/transforms/table-add-srgitems.xslt +new file mode 100644 +index 00000000..2e92d670 +--- /dev/null ++++ b/products/almalinux8/transforms/table-add-srgitems.xslt +@@ -0,0 +1,7 @@ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/table-sortbyref.xslt b/products/almalinux8/transforms/table-sortbyref.xslt +new file mode 100644 +index 00000000..bb57e7f5 +--- /dev/null ++++ b/products/almalinux8/transforms/table-sortbyref.xslt +@@ -0,0 +1,6 @@ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/table-srgmap.xslt b/products/almalinux8/transforms/table-srgmap.xslt +new file mode 100644 +index 00000000..5798a489 +--- /dev/null ++++ b/products/almalinux8/transforms/table-srgmap.xslt +@@ -0,0 +1,11 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/table-style.xslt b/products/almalinux8/transforms/table-style.xslt +new file mode 100644 +index 00000000..8b6caeab +--- /dev/null ++++ b/products/almalinux8/transforms/table-style.xslt +@@ -0,0 +1,5 @@ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf-apply-overlay-stig.xslt b/products/almalinux8/transforms/xccdf-apply-overlay-stig.xslt +new file mode 100644 +index 00000000..4789419b +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf-apply-overlay-stig.xslt +@@ -0,0 +1,8 @@ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2stigformat.xslt b/products/almalinux8/transforms/xccdf2stigformat.xslt +new file mode 100644 +index 00000000..a4e7d736 +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2stigformat.xslt +@@ -0,0 +1,7 @@ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-byref.xslt b/products/almalinux8/transforms/xccdf2table-byref.xslt +new file mode 100644 +index 00000000..1cdb679c +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-byref.xslt +@@ -0,0 +1,9 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-cce.xslt b/products/almalinux8/transforms/xccdf2table-cce.xslt +new file mode 100644 +index 00000000..f156a669 +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-cce.xslt +@@ -0,0 +1,9 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-profileanssirefs.xslt b/products/almalinux8/transforms/xccdf2table-profileanssirefs.xslt +new file mode 100644 +index 00000000..6fff5e71 +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-profileanssirefs.xslt +@@ -0,0 +1,8 @@ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-profileccirefs.xslt b/products/almalinux8/transforms/xccdf2table-profileccirefs.xslt +new file mode 100644 +index 00000000..30419e92 +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-profileccirefs.xslt +@@ -0,0 +1,9 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-profilecisrefs.xslt b/products/almalinux8/transforms/xccdf2table-profilecisrefs.xslt +new file mode 100644 +index 00000000..07d32124 +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-profilecisrefs.xslt +@@ -0,0 +1,9 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-profilenistrefs-cui.xslt b/products/almalinux8/transforms/xccdf2table-profilenistrefs-cui.xslt +new file mode 100644 +index 00000000..15efdd5f +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-profilenistrefs-cui.xslt +@@ -0,0 +1,8 @@ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-profilenistrefs.xslt b/products/almalinux8/transforms/xccdf2table-profilenistrefs.xslt +new file mode 100644 +index 00000000..ea9f8b0d +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-profilenistrefs.xslt +@@ -0,0 +1,8 @@ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/products/almalinux8/transforms/xccdf2table-stig.xslt b/products/almalinux8/transforms/xccdf2table-stig.xslt +new file mode 100644 +index 00000000..a71d8364 +--- /dev/null ++++ b/products/almalinux8/transforms/xccdf2table-stig.xslt +@@ -0,0 +1,9 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ diff --git a/shared/checks/oval/install_mcafee_hbss.xml b/shared/checks/oval/install_mcafee_hbss.xml index 7e2f41cd..1a9d9072 100644 --- a/shared/checks/oval/install_mcafee_hbss.xml @@ -29368,10 +31549,10 @@ index 00000000..91af880d + + diff --git a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml -index 1874500d..d3be6530 100644 +index 41847663..0b470d64 100644 --- a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml +++ b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml -@@ -9,6 +9,7 @@ +@@ -10,6 +10,7 @@ multi_platform_ol multi_platform_rhcos multi_platform_rhel @@ -29379,6 +31560,14 @@ index 1874500d..d3be6530 100644 multi_platform_rhv multi_platform_sle multi_platform_ubuntu +diff --git a/shared/references/disa-stig-almalinux8-v1r3-xccdf-manual.xml b/shared/references/disa-stig-almalinux8-v1r3-xccdf-manual.xml +new file mode 120000 +index 00000000..57dae81b +--- /dev/null ++++ b/shared/references/disa-stig-almalinux8-v1r3-xccdf-manual.xml +@@ -0,0 +1 @@ ++disa-stig-rhel8-v1r3-xccdf-manual.xml +\ No newline at end of file diff --git a/shared/templates/accounts_password/ansible.template b/shared/templates/accounts_password/ansible.template index f8478db7..7d4d984f 100644 --- a/shared/templates/accounts_password/ansible.template @@ -29400,7 +31589,7 @@ index 64d1be69..7bbb1772 100644 # strategy = restrict # complexity = low diff --git a/shared/templates/audit_rules_dac_modification/ansible.template b/shared/templates/audit_rules_dac_modification/ansible.template -index 70101ca7..2a6bb97a 100644 +index 2c006b45..af197a30 100644 --- a/shared/templates/audit_rules_dac_modification/ansible.template +++ b/shared/templates/audit_rules_dac_modification/ansible.template @@ -1,4 +1,4 @@ @@ -29410,7 +31599,7 @@ index 70101ca7..2a6bb97a 100644 # strategy = restrict # complexity = low diff --git a/shared/templates/audit_rules_dac_modification/bash.template b/shared/templates/audit_rules_dac_modification/bash.template -index f0d3b697..b62628b0 100644 +index b2de8d35..34a34bc3 100644 --- a/shared/templates/audit_rules_dac_modification/bash.template +++ b/shared/templates/audit_rules_dac_modification/bash.template @@ -1,4 +1,4 @@ @@ -29420,7 +31609,7 @@ index f0d3b697..b62628b0 100644 # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/shared/templates/audit_rules_file_deletion_events/ansible.template b/shared/templates/audit_rules_file_deletion_events/ansible.template -index f07ca6a9..af54286b 100644 +index 4709a61c..12c27613 100644 --- a/shared/templates/audit_rules_file_deletion_events/ansible.template +++ b/shared/templates/audit_rules_file_deletion_events/ansible.template @@ -1,4 +1,4 @@ @@ -29430,12 +31619,12 @@ index f07ca6a9..af54286b 100644 # strategy = restrict # complexity = low diff --git a/shared/templates/audit_rules_file_deletion_events/bash.template b/shared/templates/audit_rules_file_deletion_events/bash.template -index c387624c..84a287ec 100644 +index b5b4c46a..8083e2fb 100644 --- a/shared/templates/audit_rules_file_deletion_events/bash.template +++ b/shared/templates/audit_rules_file_deletion_events/bash.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # Include source function library. . /usr/share/scap-security-guide/remediation_functions @@ -29450,17 +31639,17 @@ index 4b32771c..4de3c0d4 100644 # strategy = restrict # complexity = low diff --git a/shared/templates/audit_rules_login_events/bash.template b/shared/templates/audit_rules_login_events/bash.template -index 065e8bb2..98a162fc 100644 +index 69e8be9c..7df49b30 100644 --- a/shared/templates/audit_rules_login_events/bash.template +++ b/shared/templates/audit_rules_login_events/bash.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/shared/templates/audit_rules_path_syscall/ansible.template b/shared/templates/audit_rules_path_syscall/ansible.template -index d519609f..53e935b4 100644 +index fcd2bda3..de182133 100644 --- a/shared/templates/audit_rules_path_syscall/ansible.template +++ b/shared/templates/audit_rules_path_syscall/ansible.template @@ -1,4 +1,4 @@ @@ -29470,37 +31659,43 @@ index d519609f..53e935b4 100644 # strategy = restrict # complexity = low diff --git a/shared/templates/audit_rules_path_syscall/bash.template b/shared/templates/audit_rules_path_syscall/bash.template -index c3d31aad..500781fa 100644 +index 676f6c37..71d2b52f 100644 --- a/shared/templates/audit_rules_path_syscall/bash.template +++ b/shared/templates/audit_rules_path_syscall/bash.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/shared/templates/audit_rules_privileged_commands/ansible.template b/shared/templates/audit_rules_privileged_commands/ansible.template -index 1c5a8b6b..a89bca78 100644 +index e9ef0849..390ba631 100644 --- a/shared/templates/audit_rules_privileged_commands/ansible.template +++ b/shared/templates/audit_rules_privileged_commands/ansible.template -@@ -1,4 +1,4 @@ +@@ -1,7 +1,7 @@ + {{%- if product in ["rhel8", "rhel9", "sle12", "sle15"] %}} + {{%- set perm_x=" -F perm=x" %}} + {{%- endif %}} -# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle +# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_sle # reboot = false # strategy = restrict # complexity = low diff --git a/shared/templates/audit_rules_privileged_commands/bash.template b/shared/templates/audit_rules_privileged_commands/bash.template -index 42e12671..9dddede7 100644 +index 5af362df..f376cbf3 100644 --- a/shared/templates/audit_rules_privileged_commands/bash.template +++ b/shared/templates/audit_rules_privileged_commands/bash.template -@@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +@@ -1,7 +1,7 @@ + {{%- if product in ["rhel8", "rhel9", "sle12", "sle15"] %}} + {{%- set perm_x=" -F perm=x" %}} + {{%- endif %}} +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # Include source function library. . /usr/share/scap-security-guide/remediation_functions diff --git a/shared/templates/audit_rules_unsuccessful_file_modification/ansible.template b/shared/templates/audit_rules_unsuccessful_file_modification/ansible.template -index 8e8e003a..4624f714 100644 +index 6cf90e11..49808bea 100644 --- a/shared/templates/audit_rules_unsuccessful_file_modification/ansible.template +++ b/shared/templates/audit_rules_unsuccessful_file_modification/ansible.template @@ -1,4 +1,4 @@ @@ -29510,12 +31705,12 @@ index 8e8e003a..4624f714 100644 # strategy = restrict # complexity = low diff --git a/shared/templates/audit_rules_unsuccessful_file_modification/bash.template b/shared/templates/audit_rules_unsuccessful_file_modification/bash.template -index e89ac074..94ca25ef 100644 +index 4adaa86f..e300c0d4 100644 --- a/shared/templates/audit_rules_unsuccessful_file_modification/bash.template +++ b/shared/templates/audit_rules_unsuccessful_file_modification/bash.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # Include source function library. . /usr/share/scap-security-guide/remediation_functions @@ -29540,7 +31735,7 @@ index 21524172..965c3f3f 100644 . /usr/share/scap-security-guide/remediation_functions diff --git a/shared/templates/grub2_bootloader_argument/ansible.template b/shared/templates/grub2_bootloader_argument/ansible.template -index 6f01abc6..270da388 100644 +index b0fef2d9..43346d3d 100644 --- a/shared/templates/grub2_bootloader_argument/ansible.template +++ b/shared/templates/grub2_bootloader_argument/ansible.template @@ -1,4 +1,4 @@ @@ -29550,27 +31745,27 @@ index 6f01abc6..270da388 100644 # strategy = restrict # complexity = medium diff --git a/shared/templates/grub2_bootloader_argument/bash.template b/shared/templates/grub2_bootloader_argument/bash.template -index b7478d3e..477468b2 100644 +index cecd1f99..42dd311c 100644 --- a/shared/templates/grub2_bootloader_argument/bash.template +++ b/shared/templates/grub2_bootloader_argument/bash.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu - {{% if product in ["rhel7", "ol7"] %}} - # Correct the form of default kernel command line in GRUB + {{% if product in ["rhel7", "ol7"] or 'ubuntu' in product %}} + {{% if '/' in ARG_NAME %}} diff --git a/shared/templates/kernel_module_disabled/ansible.template b/shared/templates/kernel_module_disabled/ansible.template -index c4a83ad3..08b03872 100644 +index 2526baf7..7962d86b 100644 --- a/shared/templates/kernel_module_disabled/ansible.template +++ b/shared/templates/kernel_module_disabled/ansible.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv,multi_platform_ubuntu,multi_platform_sle # reboot = true # strategy = disable # complexity = low diff --git a/shared/templates/kernel_module_disabled/bash.template b/shared/templates/kernel_module_disabled/bash.template -index f70a9925..7da52ec5 100644 +index a0998bb9..f433e00d 100644 --- a/shared/templates/kernel_module_disabled/bash.template +++ b/shared/templates/kernel_module_disabled/bash.template @@ -1,4 +1,4 @@ @@ -29580,32 +31775,32 @@ index f70a9925..7da52ec5 100644 # strategy = disable # complexity = low diff --git a/shared/templates/mount/anaconda.template b/shared/templates/mount/anaconda.template -index 5093c926..7893bb44 100644 +index fdcb4ee3..0d1d8dc2 100644 --- a/shared/templates/mount/anaconda.template +++ b/shared/templates/mount/anaconda.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # reboot = false # strategy = enable # complexity = low diff --git a/shared/templates/mount_option/anaconda.template b/shared/templates/mount_option/anaconda.template -index 0a54865e..e3208649 100644 +index 083b0ef0..14f7018a 100644 --- a/shared/templates/mount_option/anaconda.template +++ b/shared/templates/mount_option/anaconda.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # reboot = false # strategy = enable # complexity = low diff --git a/shared/templates/mount_option_removable_partitions/anaconda.template b/shared/templates/mount_option_removable_partitions/anaconda.template -index b4510ae8..ca6fd4a1 100644 +index 8665fb91..07cd9e3a 100644 --- a/shared/templates/mount_option_removable_partitions/anaconda.template +++ b/shared/templates/mount_option_removable_partitions/anaconda.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv -+# platform = Red Hat Enterprise Linux 7,Red Hat Enterprise Linux 8,AlmaLinux 8,multi_platform_fedora,multi_platform_ol,multi_platform_rhv +-# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_rhv ++# platform = multi_platform_rhel,multi_platform_almalinux,multi_platform_fedora,multi_platform_ol,multi_platform_rhv # reboot = false # strategy = enable # complexity = low @@ -29689,7 +31884,7 @@ index 1ab45652..724e7b77 100644 # strategy = disable # complexity = low diff --git a/shared/templates/service_enabled/bash.template b/shared/templates/service_enabled/bash.template -index 5a6b09f9..96393898 100644 +index 5571989a..8d3ea035 100644 --- a/shared/templates/service_enabled/bash.template +++ b/shared/templates/service_enabled/bash.template @@ -1,4 +1,4 @@ @@ -29709,38 +31904,38 @@ index a762794a..bd3f2d9c 100644 # strategy = disable # complexity = low diff --git a/shared/templates/zipl_bls_entries_option/ansible.template b/shared/templates/zipl_bls_entries_option/ansible.template -index 7e73d391..abe8838a 100644 +index 336775e4..6411d1b9 100644 --- a/shared/templates/zipl_bls_entries_option/ansible.template +++ b/shared/templates/zipl_bls_entries_option/ansible.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # reboot = true # strategy = configure # complexity = medium diff --git a/shared/templates/zipl_bls_entries_option/bash.template b/shared/templates/zipl_bls_entries_option/bash.template -index d0faeb80..e0b776fe 100644 +index 25cd7432..a415f2a3 100644 --- a/shared/templates/zipl_bls_entries_option/bash.template +++ b/shared/templates/zipl_bls_entries_option/bash.template @@ -1,4 +1,4 @@ --# platform = Red Hat Enterprise Linux 8 -+# platform = Red Hat Enterprise Linux 8,AlmaLinux 8 +-# platform = Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9 ++# platform = Red Hat Enterprise Linux 8,AlmaLinux 8,Red Hat Enterprise Linux 9 # Correct BLS option using grubby, which is a thin wrapper around BLS operations grubby --update-kernel=ALL --args="{{{ ARG_NAME }}}={{{ ARG_VALUE }}}" diff --git a/ssg/constants.py b/ssg/constants.py -index 589c955f..736b4228 100644 +index e2d30772..6138b9a4 100644 --- a/ssg/constants.py +++ b/ssg/constants.py -@@ -5,6 +5,7 @@ import datetime - import os.path +@@ -6,6 +6,7 @@ import os + import time product_directories = [ + 'almalinux8', 'chromium', 'debian9', 'debian10', 'example', -@@ -140,6 +141,7 @@ PKG_MANAGER_TO_CONFIG_FILE = { +@@ -153,6 +154,7 @@ PKG_MANAGER_TO_CONFIG_FILE = { } FULL_NAME_TO_PRODUCT_MAPPING = { @@ -29748,7 +31943,7 @@ index 589c955f..736b4228 100644 "Chromium": "chromium", "Debian 9": "debian9", "Debian 10": "debian10", -@@ -180,10 +182,11 @@ REF_PREFIX_MAP = { +@@ -194,10 +196,11 @@ REF_PREFIX_MAP = { "stigid": "DISA-STIG", } @@ -29761,7 +31956,7 @@ index 589c955f..736b4228 100644 "multi_platform_debian": ["debian9", "debian10"], "multi_platform_example": ["example"], "multi_platform_fedora": ["fedora"], -@@ -362,6 +365,7 @@ MAKEFILE_ID_TO_PRODUCT_MAP = { +@@ -376,6 +379,7 @@ MAKEFILE_ID_TO_PRODUCT_MAP = { 'ol': 'Oracle Linux', 'ocp': 'Red Hat OpenShift Container Platform', 'rhcos': 'Red Hat Enterprise Linux CoreOS', @@ -29783,13 +31978,13 @@ index bce7683a..9d34864f 100644 } diff --git a/tests/unit/ssg-module/data/file_owner_grub2_cfg.yml b/tests/unit/ssg-module/data/file_owner_grub2_cfg.yml -index 8d79d102..77dc3115 100644 +index b0be0b4b..ef41579b 100644 --- a/tests/unit/ssg-module/data/file_owner_grub2_cfg.yml +++ b/tests/unit/ssg-module/data/file_owner_grub2_cfg.yml -@@ -19,7 +19,7 @@ oval_external_content: null - platform: machine +@@ -20,7 +20,7 @@ platforms: + - machine # TODO: Make Rule get this from group, so it can be saved here - # platform: null + # platforms: null -prodtype: rhel7,rhel8,fedora,ol7,ol8 +prodtype: rhel7,rhel8,almalinux8,fedora,ol7,ol8 rationale: Only root should be able to modify important boot parameters. @@ -29806,20 +32001,20 @@ index ff0b30f0..0116294f 100644 # strategy = restrict # complexity = low diff --git a/tests/unit/ssg-module/test_playbook_builder_data/rules/selinux_state.yml b/tests/unit/ssg-module/test_playbook_builder_data/rules/selinux_state.yml -index 08d2749a..db93b129 100644 +index 2697e7af..c7d0f18d 100644 --- a/tests/unit/ssg-module/test_playbook_builder_data/rules/selinux_state.yml +++ b/tests/unit/ssg-module/test_playbook_builder_data/rules/selinux_state.yml -@@ -13,7 +13,7 @@ ocil: 'Check the file /etc/selinux/config and ensure the following line - ocil_clause: SELINUX is not set to enforcing +@@ -14,7 +14,7 @@ ocil_clause: SELINUX is not set to enforcing oval_external_content: null - platform: machine + platforms: + - machine -prodtype: rhel7,rhel8,fedora,ol7,ol8,rhv4 +prodtype: rhel7,rhel8,almalinux8,fedora,ol7,ol8,rhv4 rationale: 'Setting the SELinux state to enforcing ensures SELinux is able to confine potentially compromised processes to the security policy, which is designed to diff --git a/utils/ansible_playbook_to_role.py b/utils/ansible_playbook_to_role.py -index 95264af9..810fa55f 100755 +index 7513b37e..3dd14360 100755 --- a/utils/ansible_playbook_to_role.py +++ b/utils/ansible_playbook_to_role.py @@ -57,6 +57,7 @@ yaml.add_constructor(_mapping_tag, dict_constructor) @@ -29827,6 +32022,6 @@ index 95264af9..810fa55f 100755 "rhel7", "rhel8", + "almalinux8", - "rhv4", ]) + PROFILE_WHITELIST = set([ diff --git a/SOURCES/disable-not-in-good-shape-profiles.patch b/SOURCES/disable-not-in-good-shape-profiles.patch index 1d82938..c5b8d9a 100644 --- a/SOURCES/disable-not-in-good-shape-profiles.patch +++ b/SOURCES/disable-not-in-good-shape-profiles.patch @@ -1,23 +1,7 @@ -From 48e959ebf2b892fefa642f19bc8cc1d2d639fb29 Mon Sep 17 00:00:00 2001 -From: Watson Sato -Date: Thu, 3 Dec 2020 14:35:47 +0100 -Subject: [PATCH] Disable profiles that are not in good shape for RHEL8 - ---- - rhel8/CMakeLists.txt | 6 ------ - rhel8/profiles/anssi_bp28_high.profile | 2 +- - rhel8/profiles/cjis.profile | 2 +- - rhel8/profiles/ism_o.profile | 2 +- - rhel8/profiles/rhelh-stig.profile | 2 +- - rhel8/profiles/rhelh-vpp.profile | 2 +- - rhel8/profiles/rht-ccp.profile | 2 +- - rhel8/profiles/standard.profile | 2 +- - 11 files changed, 10 insertions(+), 16 deletions(-) - diff --git a/rhel8/CMakeLists.txt b/rhel8/CMakeLists.txt index d61689c97..5e444a101 100644 ---- a/rhel8/CMakeLists.txt -+++ b/rhel8/CMakeLists.txt +--- a/products/rhel8/CMakeLists.txt ++++ b/products/rhel8/CMakeLists.txt @@ -14,15 +14,9 @@ ssg_build_html_table_by_ref(${PRODUCT} "cis") ssg_build_html_table_by_ref(${PRODUCT} "pcidss") ssg_build_html_table_by_ref(${PRODUCT} "anssi") @@ -34,70 +18,30 @@ index d61689c97..5e444a101 100644 ssg_build_html_cce_table(${PRODUCT}) ssg_build_html_srgmap_tables(${PRODUCT} "stig" ${DISA_SRG_TYPE}) -diff --git a/rhel8/profiles/anssi_bp28_high.profile b/rhel8/profiles/anssi_bp28_high.profile -index ccad93d67..6a854378c 100644 ---- a/rhel8/profiles/anssi_bp28_high.profile -+++ b/rhel8/profiles/anssi_bp28_high.profile -@@ -1,4 +1,4 @@ --documentation_complete: true -+documentation_complete: false - - title: 'ANSSI BP-028 (high)' - -diff --git a/rhel8/profiles/cjis.profile b/rhel8/profiles/cjis.profile +diff --git a/products/rhel8/profiles/cjis.profile b/rhel8/profiles/cjis.profile index 035d2705b..c6475f33e 100644 ---- a/rhel8/profiles/cjis.profile -+++ b/rhel8/profiles/cjis.profile +--- a/products/rhel8/profiles/cjis.profile ++++ b/products/rhel8/profiles/cjis.profile @@ -1,4 +1,4 @@ -documentation_complete: true +documentation_complete: false metadata: version: 5.4 -diff --git a/rhel8/profiles/ism_o.profile b/rhel8/profiles/ism_o.profile -index a3c427c01..4605dea3b 100644 ---- a/rhel8/profiles/ism_o.profile -+++ b/rhel8/profiles/ism_o.profile -@@ -1,4 +1,4 @@ --documentation_complete: true -+documentation_complete: false - - metadata: - SMEs: -diff --git a/rhel8/profiles/rhelh-stig.profile b/rhel8/profiles/rhelh-stig.profile -index 1efca5f44..c3d0b0964 100644 ---- a/rhel8/profiles/rhelh-stig.profile -+++ b/rhel8/profiles/rhelh-stig.profile -@@ -1,4 +1,4 @@ --documentation_complete: true -+documentation_complete: false - - title: '[DRAFT] DISA STIG for Red Hat Enterprise Linux Virtualization Host (RHELH)' - -diff --git a/rhel8/profiles/rhelh-vpp.profile b/rhel8/profiles/rhelh-vpp.profile -index 2baee6d66..8592d7aaf 100644 ---- a/rhel8/profiles/rhelh-vpp.profile -+++ b/rhel8/profiles/rhelh-vpp.profile -@@ -1,4 +1,4 @@ --documentation_complete: true -+documentation_complete: false - - title: 'VPP - Protection Profile for Virtualization v. 1.0 for Red Hat Enterprise Linux Hypervisor (RHELH)' - -diff --git a/rhel8/profiles/rht-ccp.profile b/rhel8/profiles/rht-ccp.profile +diff --git a/products/rhel8/profiles/rht-ccp.profile b/rhel8/profiles/rht-ccp.profile index c84579592..164ec98c4 100644 ---- a/rhel8/profiles/rht-ccp.profile -+++ b/rhel8/profiles/rht-ccp.profile +--- a/products/rhel8/profiles/rht-ccp.profile ++++ b/products/rhel8/profiles/rht-ccp.profile @@ -1,4 +1,4 @@ -documentation_complete: true +documentation_complete: false title: 'Red Hat Corporate Profile for Certified Cloud Providers (RH CCP)' -diff --git a/rhel8/profiles/standard.profile b/rhel8/profiles/standard.profile +diff --git a/products/rhel8/profiles/standard.profile b/rhel8/profiles/standard.profile index a63ae2cf3..da669bb84 100644 ---- a/rhel8/profiles/standard.profile -+++ b/rhel8/profiles/standard.profile +--- a/products/rhel8/profiles/standard.profile ++++ b/products/rhel8/profiles/standard.profile @@ -1,4 +1,4 @@ -documentation_complete: true +documentation_complete: false diff --git a/SOURCES/remove-ANSSI-high-ks.patch b/SOURCES/remove-ANSSI-high-ks.patch deleted file mode 100644 index 5298c70..0000000 --- a/SOURCES/remove-ANSSI-high-ks.patch +++ /dev/null @@ -1,187 +0,0 @@ -From 8e43a6a6432a8cbeb5742771ddbd0856669a7878 Mon Sep 17 00:00:00 2001 -From: Watson Sato -Date: Wed, 17 Feb 2021 15:36:59 +0100 -Subject: [PATCH] Remove kickstart for profile not shipped - -RHEL-8 ANSSI high is not shipped at the momment ---- - .../ssg-rhel8-anssi_bp28_high-ks.cfg | 167 ------------------ - 1 file changed, 167 deletions(-) - delete mode 100644 rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg - -diff --git a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg b/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg -deleted file mode 100644 -index b5c09253a..000000000 ---- a/rhel8/kickstart/ssg-rhel8-anssi_bp28_high-ks.cfg -+++ /dev/null -@@ -1,167 +0,0 @@ --# SCAP Security Guide ANSSI BP-028 (high) profile kickstart for Red Hat Enterprise Linux 8 --# Version: 0.0.1 --# Date: 2020-12-10 --# --# Based on: --# https://pykickstart.readthedocs.io/en/latest/ --# http://usgcb.nist.gov/usgcb/content/configuration/workstation-ks.cfg -- --# Specify installation method to use for installation --# To use a different one comment out the 'url' one below, update --# the selected choice with proper options & un-comment it --# --# Install from an installation tree on a remote server via FTP or HTTP: --# --url the URL to install from --# --# Example: --# --# url --url=http://192.168.122.1/image --# --# Modify concrete URL in the above example appropriately to reflect the actual --# environment machine is to be installed in --# --# Other possible / supported installation methods: --# * install from the first CD-ROM/DVD drive on the system: --# --# cdrom --# --# * install from a directory of ISO images on a local drive: --# --# harddrive --partition=hdb2 --dir=/tmp/install-tree --# --# * install from provided NFS server: --# --# nfs --server= --dir= [--opts=] --# --# Set language to use during installation and the default language to use on the installed system (required) --lang en_US.UTF-8 -- --# Set system keyboard type / layout (required) --keyboard us -- --# Configure network information for target system and activate network devices in the installer environment (optional) --# --onboot enable device at a boot time --# --device device to be activated and / or configured with the network command --# --bootproto method to obtain networking configuration for device (default dhcp) --# --noipv6 disable IPv6 on this device --# --# NOTE: Usage of DHCP will fail CCE-27021-5 (DISA FSO RHEL-06-000292). To use static IP configuration, --# "--bootproto=static" must be used. For example: --# network --bootproto=static --ip=10.0.2.15 --netmask=255.255.255.0 --gateway=10.0.2.254 --nameserver 192.168.2.1,192.168.3.1 --# --network --onboot yes --bootproto dhcp --noipv6 -- --# Set the system's root password (required) --# Plaintext password is: server --# Refer to e.g. --# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw --# to see how to create encrypted password form for different plaintext password --rootpw --iscrypted $6$0WWGZ1e6icT$1KiHZK.Nzp3HQerfiy8Ic3pOeCWeIzA.zkQ7mkvYT3bNC5UeGK2ceE5b6TkSg4D/kiSudkT04QlSKknsrNE220 -- --# The selected profile will restrict root login --# Add a user that can login and escalate privileges --# Plaintext password is: admin123 --user --name=admin --groups=wheel --password=$6$Ga6ZnIlytrWpuCzO$q0LqT1USHpahzUafQM9jyHCY9BiE5/ahXLNWUMiVQnFGblu0WWGZ1e6icTaCGO4GNgZNtspp1Let/qpM7FMVB0 --iscrypted -- --# Configure firewall settings for the system (optional) --# --enabled reject incoming connections that are not in response to outbound requests --# --ssh allow sshd service through the firewall --firewall --enabled --ssh -- --# State of SELinux on the installed system (optional) --# Defaults to enforcing --selinux --enforcing -- --# Set the system time zone (required) --timezone --utc America/New_York -- --# Specify how the bootloader should be installed (required) --# Plaintext password is: password --# Refer to e.g. --# https://pykickstart.readthedocs.io/en/latest/commands.html#rootpw --# to see how to create encrypted password form for different plaintext password --bootloader --location=mbr --append="audit=1 audit_backlog_limit=8192" --password=$6$zCPaBARiNlBYUAS7$40phthWpqvaPVz3QUeIK6n5qoazJDJD5Nlc9OKy5SyYoX9Rt4jFaLjzqJCwpgR4RVAEFSADsqQot0WKs5qNto0 -- --# Initialize (format) all disks (optional) --zerombr -- --# The following partition layout scheme assumes disk of size 20GB or larger --# Modify size of partitions appropriately to reflect actual machine's hardware --# --# Remove Linux partitions from the system prior to creating new ones (optional) --# --linux erase all Linux partitions --# --initlabel initialize the disk label to the default based on the underlying architecture --clearpart --linux --initlabel -- --# Create primary system partitions (required for installs) --part /boot --fstype=xfs --size=512 --fsoptions="nodev,nosuid,noexec" --part pv.01 --grow --size=1 -- --# Create a Logical Volume Management (LVM) group (optional) --volgroup VolGroup --pesize=4096 pv.01 -- --# Create particular logical volumes (optional) --logvol / --fstype=xfs --name=LogVol06 --vgname=VolGroup --size=3192 --grow --# Ensure /usr Located On Separate Partition --logvol /usr --fstype=xfs --name=LogVol08 --vgname=VolGroup --size=5000 --fsoptions="nodev" --# Ensure /opt Located On Separate Partition --logvol /opt --fstype=xfs --name=LogVol09 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" --# Ensure /srv Located On Separate Partition --logvol /srv --fstype=xfs --name=LogVol10 --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid" --# Ensure /home Located On Separate Partition --logvol /home --fstype=xfs --name=home --vgname=VolGroup --size=1024 --fsoptions="nodev" --# Ensure /tmp Located On Separate Partition --logvol /tmp --fstype=xfs --name=tmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" --# Ensure /var/tmp Located On Separate Partition --logvol /var/tmp --fstype=xfs --name=vartmp --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" --# Ensure /var Located On Separate Partition --logvol /var --fstype=xfs --name=var --vgname=VolGroup --size=3072 --fsoptions="nodev" --# Ensure /var/log Located On Separate Partition --logvol /var/log --fstype=xfs --name=log --vgname=VolGroup --size=1024 --fsoptions="nodev,nosuid,noexec" --# Ensure /var/log/audit Located On Separate Partition --logvol /var/log/audit --fstype=xfs --name=audit --vgname=VolGroup --size=512 --fsoptions="nodev,nosuid,noexec" --logvol swap --name=swap --vgname=VolGroup --size=2016 -- --# The OpenSCAP installer add-on is used to apply SCAP (Security Content Automation Protocol) --# content - security policies - on the installed system.This add-on has been enabled by default --# since Red Hat Enterprise Linux 7.2. When enabled, the packages necessary to provide this --# functionality will automatically be installed. However, by default, no policies are enforced, --# meaning that no checks are performed during or after installation unless specifically configured. --# --# Important --# Applying a security policy is not necessary on all systems. This screen should only be used --# when a specific policy is mandated by your organization rules or government regulations. --# Unlike most other commands, this add-on does not accept regular options, but uses key-value --# pairs in the body of the %addon definition instead. These pairs are whitespace-agnostic. --# Values can be optionally enclosed in single quotes (') or double quotes ("). --# --# The following keys are recognized by the add-on: --# content-type - Type of the security content. Possible values are datastream, archive, rpm, and scap-security-guide. --# - If the content-type is scap-security-guide, the add-on will use content provided by the --# scap-security-guide package, which is present on the boot media. This means that all other keys except profile will have no effect. --# content-url - Location of the security content. The content must be accessible using HTTP, HTTPS, or FTP; local storage is currently not supported. A network connection must be available to reach content definitions in a remote location. --# datastream-id - ID of the data stream referenced in the content-url value. Used only if content-type is datastream. --# xccdf-id - ID of the benchmark you want to use. --# xccdf-path - Path to the XCCDF file which should be used; given as a relative path in the archive. --# profile - ID of the profile to be applied. Use default to apply the default profile. --# fingerprint - A MD5, SHA1 or SHA2 checksum of the content referenced by content-url. --# tailoring-path - Path to a tailoring file which should be used, given as a relative path in the archive. --# --# The following is an example %addon org_fedora_oscap section which uses content from the --# scap-security-guide on the installation media: --%addon org_fedora_oscap -- content-type = scap-security-guide -- profile = xccdf_org.ssgproject.content_profile_anssi_bp28_high --%end -- --# Packages selection (%packages section is required) --%packages -- --# Require @Base --@Base -- --%end # End of %packages section -- --# Reboot after the installation is complete (optional) --# --eject attempt to eject CD or DVD media before rebooting --reboot --eject --- -2.26.2 - diff --git a/SOURCES/scap-security-guide-0.1.55-OL7_DISA_STIG_v2r1_update-PR_6538.patch b/SOURCES/scap-security-guide-0.1.55-OL7_DISA_STIG_v2r1_update-PR_6538.patch deleted file mode 100644 index 6ab80bd..0000000 --- a/SOURCES/scap-security-guide-0.1.55-OL7_DISA_STIG_v2r1_update-PR_6538.patch +++ /dev/null @@ -1,11626 +0,0 @@ -From 47656aab42dbd366b4d0602ffa64eff9b0ce1985 Mon Sep 17 00:00:00 2001 -From: Federico Ramirez -Date: Fri, 15 Jan 2021 09:49:13 -0600 -Subject: [PATCH 1/3] OL7 DISA STIG v2r1 update - -Signed-off-by: Federico Ramirez ---- - .../accounts_passwords_pam_faillock_deny/rule.yml | 2 +- - .../accounts_passwords_pam_faillock_interval/rule.yml | 2 +- - .../accounts_passwords_pam_faillock_unlock_time/rule.yml | 2 +- - .../smart_card_login/install_smartcard_packages/rule.yml | 2 +- - .../partitions/mount_option_dev_shm_nodev/rule.yml | 2 +- - .../partitions/mount_option_dev_shm_nosuid/rule.yml | 2 +- - .../guide/system/selinux/selinux_policytype/rule.yml | 3 ++- - .../system/selinux/selinux_user_login_roles/rule.yml | 2 +- - .../dconf_gnome_disable_ctrlaltdel_reboot/rule.yml | 3 ++- - .../rpm_verification/rpm_verify_ownership/rule.yml | 2 +- - .../software/sudo/sudo_remove_no_authenticate/rule.yml | 1 + - ol7/profiles/stig.profile | 9 ++++----- - 12 files changed, 17 insertions(+), 15 deletions(-) - -diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml -index e09367be0a..ccee5dd048 100644 ---- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml -+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_deny/rule.yml -@@ -33,7 +33,7 @@ references: - cis: 5.3.2 - cjis: 5.5.3 - cui: 3.1.8 -- disa: CCI-000044,CCI-002238 -+ disa: CCI-000044,CCI-002236,CCI-002237,CCI-002238 - nist: CM-6(a),AC-7(a) - nist-csf: PR.AC-7 - ospp: FIA_AFL.1 -diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml -index 14aad917bd..d1b9c396ae 100644 ---- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml -+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_interval/rule.yml -@@ -40,7 +40,7 @@ identifiers: - - references: - stigid@ol7: OL07-00-010320 -- disa: CCI-000044,CCI-002238 -+ disa: CCI-000044,CCI-002236,CCI-002237,CCI-002238 - nist: CM-6(a),AC-7(a) - nist-csf: PR.AC-7 - ospp: FIA_AFL.1 -diff --git a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml -index 2888c9ab9a..2fff1c6011 100644 ---- a/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml -+++ b/linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_unlock_time/rule.yml -@@ -36,7 +36,7 @@ references: - cis: 5.3.2 - cjis: 5.5.3 - cui: 3.1.8 -- disa: CCI-000044,CCI-002238 -+ disa: CCI-000044,CCI-002236,CCI-002237,CCI-002238 - nist: CM-6(a),AC-7(b) - nist-csf: PR.AC-7 - ospp: FIA_AFL.1 -diff --git a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml -index 8bb91bd3e4..b3210d6adc 100644 ---- a/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml -+++ b/linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/install_smartcard_packages/rule.yml -@@ -30,7 +30,7 @@ references: - stigid@ol7: OL07-00-041001 - disa: CCI-000765,CCI-001948,CCI-001953,CCI-001954 - nist: CM-6(a) -- srg: SRG-OS-000105-GPOS-00052,SRG-OS-000375-GPOS-00160,SRG-OS-000376-GPOS-00161,SRG-OS-000377-GPOS-00162 -+ srg: SRG-OS-000105-GPOS-00052,SRG-OS-000375-GPOS-00160,SRG-OS-000375-GPOS-00161,SRG-OS-000377-GPOS-00162 - stigid@rhel7: RHEL-07-041001 - - ocil_clause: 'smartcard software is not installed' -diff --git a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml -index 140a2eafc0..f8359dc122 100644 ---- a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml -+++ b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nodev/rule.yml -@@ -24,7 +24,7 @@ identifiers: - references: - cis@rhel8: 1.1.5 - cis@ubuntu1804: 1.1.14 -- stigid@ol7: OL07-00-021022 -+ stigid@ol7: OL07-00-021024 - stigid@rhel7: RHEL-07-021022 - disa: CCI-001764 - nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 -diff --git a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml -index be127be367..8dc400965b 100644 ---- a/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml -+++ b/linux_os/guide/system/permissions/partitions/mount_option_dev_shm_nosuid/rule.yml -@@ -24,7 +24,7 @@ identifiers: - references: - cis@rhel8: 1.1.16 - cis@ubuntu1804: 1.1.15 -- stigid@ol7: OL07-00-021023 -+ stigid@ol7: OL07-00-021024 - stigid@rhel7: RHEL-07-021023 - disa: CCI-001764 - nist: CM-7(a),CM-7(b),CM-6(a),AC-6,AC-6(1),MP-7 -diff --git a/linux_os/guide/system/selinux/selinux_policytype/rule.yml b/linux_os/guide/system/selinux/selinux_policytype/rule.yml -index ee2a6054b2..ba2b9dc94f 100644 ---- a/linux_os/guide/system/selinux/selinux_policytype/rule.yml -+++ b/linux_os/guide/system/selinux/selinux_policytype/rule.yml -@@ -33,10 +33,11 @@ identifiers: - cce@rhcos4: CCE-82532-3 - - references: -+ stigid@ol7: OL07-00-020220 - anssi: BP28(R66) - cis@rhel8: 1.7.1.3 - cui: 3.1.2,3.7.2 -- disa: CCI-002696 -+ disa: CCI-002165,CCI-002696 - hipaa: 164.308(a)(1)(ii)(D),164.308(a)(3),164.308(a)(4),164.310(b),164.310(c),164.312(a),164.312(e) - nist: AC-3,AC-3(3)(a),AU-9,SC-7(21) - nist-csf: DE.AE-1,ID.AM-3,PR.AC-4,PR.AC-5,PR.AC-6,PR.DS-5,PR.PT-1,PR.PT-3,PR.PT-4 -diff --git a/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml b/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml -index 58500a63f8..1a02b545d3 100644 ---- a/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml -+++ b/linux_os/guide/system/selinux/selinux_user_login_roles/rule.yml -@@ -37,7 +37,7 @@ identifiers: - - references: - stigid@ol7: OL07-00-020020 -- disa: CCI-002235 -+ disa: CCI-002165,CCI-002235 - srg: SRG-OS-000324-GPOS-00125 - stigid@rhel7: RHEL-07-020020 - -diff --git a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml -index c1a86bf4c8..d666768bce 100644 ---- a/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml -+++ b/linux_os/guide/system/software/gnome/gnome_system_settings/dconf_gnome_disable_ctrlaltdel_reboot/rule.yml -@@ -1,6 +1,6 @@ - documentation_complete: true - --prodtype: fedora,rhel7,rhel8 -+prodtype: fedora,ol7,rhel7,rhel8 - - title: 'Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3' - -@@ -32,6 +32,7 @@ identifiers: - cce@rhel7: CCE-80124-1 - - references: -+ stigid@ol7: OL07-00-020231 - cui: 3.1.2 - disa: CCI-000366 - nist: CM-6(a),AC-6(1),CM-7(b) -diff --git a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml -index 24c4517aa7..d4f76c4ebd 100644 ---- a/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml -+++ b/linux_os/guide/system/software/integrity/software-integrity/rpm_verification/rpm_verify_ownership/rule.yml -@@ -41,7 +41,7 @@ references: - nist: CM-6(d),CM-6(c),SI-7,SI-7(1),SI-7(6),AU-9(3) - nist-csf: PR.AC-4,PR.DS-5,PR.IP-1,PR.PT-1 - pcidss: Req-11.5 -- srg: SRG-OS-000257-GPOS-00098,SRG-OS-000278-GPOS-00108 -+ srg: SRG-OS-000256-GPOS-00097,SRG-OS-000257-GPOS-00098,SRG-OS-000278-GPOS-00108 - isa-62443-2013: 'SR 2.1,SR 2.10,SR 2.11,SR 2.12,SR 2.8,SR 2.9,SR 5.2,SR 7.6' - isa-62443-2009: 4.3.3.3.9,4.3.3.5.8,4.3.3.7.3,4.3.4.3.2,4.3.4.3.3,4.3.4.4.7,4.4.2.1,4.4.2.2,4.4.2.4 - cobit5: APO01.06,APO11.04,BAI03.05,BAI10.01,BAI10.02,BAI10.03,BAI10.05,DSS05.04,DSS05.07,DSS06.02,MEA02.01 -diff --git a/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml b/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml -index db826d1123..e704df8983 100644 ---- a/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml -+++ b/linux_os/guide/system/software/sudo/sudo_remove_no_authenticate/rule.yml -@@ -23,6 +23,7 @@ identifiers: - cce@sle12: CCE-83013-3 - - references: -+ stigid@ol7: OL07-00-010350 - anssi: BP28(R5),BP28(R59) - disa: CCI-002038 - nist: IA-11,CM-6(a) -diff --git a/ol7/profiles/stig.profile b/ol7/profiles/stig.profile -index 1cfad16c08..ecb6cccce4 100644 ---- a/ol7/profiles/stig.profile -+++ b/ol7/profiles/stig.profile -@@ -4,7 +4,7 @@ title: 'DISA STIG for Oracle Linux 7' - - description: |- - This profile contains configuration checks that align to the -- DISA STIG for Oracle Linux V1R1. -+ DISA STIG for Oracle Linux V2R1. - - selections: - - login_banner_text=dod_banners -@@ -55,7 +55,6 @@ selections: - - dconf_gnome_screensaver_lock_locked - - dconf_gnome_enable_smartcard_auth - - dconf_gnome_screensaver_idle_delay -- - package_screen_installed - - dconf_gnome_screensaver_idle_activation_enabled - - dconf_gnome_screensaver_idle_activation_locked - - dconf_gnome_screensaver_lock_delay -@@ -115,7 +114,6 @@ selections: - - accounts_no_uid_except_zero - - no_files_unowned_by_user - - file_permissions_ungroupowned -- - accounts_user_interactive_home_directory_defined - - accounts_have_homedir_login_defs - - accounts_user_interactive_home_directory_exists - - file_permissions_home_directories -@@ -144,7 +142,6 @@ selections: - - service_kdump_disabled - - partition_for_home - - partition_for_var -- - partition_for_var_log_audit - - partition_for_tmp - - grub2_enable_fips_mode - - aide_verify_acls -@@ -159,7 +156,6 @@ selections: - - auditd_audispd_configure_remote_server - - auditd_audispd_encrypt_sent_records - - auditd_audispd_disk_full_action -- - auditd_name_format - - auditd_data_retention_space_left - - auditd_data_retention_space_left_action - - auditd_data_retention_action_mail_acct -@@ -288,3 +284,6 @@ selections: - - audit_rules_usergroup_modification_opasswd - - sysctl_net_ipv4_conf_all_accept_redirects - - wireless_disable_interfaces -+ - sudo_remove_no_authenticate -+ - selinux_policytype -+ - dconf_gnome_disable_ctrlaltdel_reboot - -From 666826067d2b2bbaacd0fc6f32c93cfecdb8b010 Mon Sep 17 00:00:00 2001 -From: Federico Ramirez -Date: Fri, 15 Jan 2021 09:49:45 -0600 -Subject: [PATCH 2/3] Update OL7 stig overlay to match v2r1 - -Signed-off-by: Federico Ramirez ---- - ol7/overlays/stig_overlay.xml | 993 +++- - .../disa-stig-ol7-v1r1-xccdf-manual.xml | 4928 ---------------- - .../disa-stig-ol7-v2r1-xccdf-manual.xml | 5072 +++++++++++++++++ - 3 files changed, 6063 insertions(+), 4930 deletions(-) - delete mode 100644 shared/references/disa-stig-ol7-v1r1-xccdf-manual.xml - create mode 100644 shared/references/disa-stig-ol7-v2r1-xccdf-manual.xml - -diff --git a/ol7/overlays/stig_overlay.xml b/ol7/overlays/stig_overlay.xml -index 92584b1b78..2345ff7494 100644 ---- a/ol7/overlays/stig_overlay.xml -+++ b/ol7/overlays/stig_overlay.xml -@@ -1,2 +1,991 @@ -- --</overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010020" ruleid="rpm_verify_hashes" severity="high"><VMSinfo SVKey="108151" VKey="99047" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values." /></overlay><overlay disa="1388" owner="disastig" ownerid="OL07-00-010030" ruleid="dconf_gnome_banner_enabled" severity="medium"><VMSinfo SVKey="108153" VKey="99049" VRelease="r1" /><title text="The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon." /></overlay><overlay disa="48" owner="disastig" ownerid="OL07-00-010040" ruleid="dconf_gnome_login_banner_text" severity="medium"><VMSinfo SVKey="108155" VKey="99051" VRelease="r1" /><title text="The Oracle Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon." /></overlay><overlay disa="48" owner="disastig" ownerid="OL07-00-010050" ruleid="banner_etc_issue" severity="medium"><VMSinfo SVKey="108157" VKey="99053" VRelease="r1" /><title text="The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon." /></overlay><overlay disa="58" owner="disastig" ownerid="OL07-00-010060" ruleid="dconf_gnome_screensaver_lock_enabled" severity="medium"><VMSinfo SVKey="108159" VKey="99055" VRelease="r1" /><title text="The Oracle Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures." /></overlay><overlay disa="1948" owner="disastig" ownerid="OL07-00-010061" ruleid="dconf_gnome_enable_smartcard_auth" severity="medium"><VMSinfo SVKey="108161" VKey="99057" VRelease="r1" /><title text="The Oracle Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010062" ruleid="dconf_gnome_screensaver_lock_locked" severity="medium"><VMSinfo SVKey="108163" VKey="99059" VRelease="r1" /><title text="The Oracle Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010070" ruleid="dconf_gnome_screensaver_idle_delay" severity="medium"><VMSinfo SVKey="108165" VKey="99061" VRelease="r1" /><title text="The Oracle Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010081" ruleid="dconf_gnome_screensaver_user_locks" severity="medium"><VMSinfo SVKey="108167" VKey="99063" VRelease="r1" /><title text="The Oracle Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010082" ruleid="dconf_gnome_session_idle_user_locks" severity="medium"><VMSinfo SVKey="108169" VKey="99065" VRelease="r1" /><title text="The Oracle Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010090" ruleid="package_screen_installed" severity="medium"><VMSinfo SVKey="108171" VKey="99067" VRelease="r1" /><title text="The Oracle Linux operating system must have the screen package installed." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010100" ruleid="dconf_gnome_screensaver_idle_activation_enabled" severity="medium"><VMSinfo SVKey="108173" VKey="99069" VRelease="r1" /><title text="The Oracle Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010101" ruleid="dconf_gnome_screensaver_idle_activation_locked" severity="medium"><VMSinfo SVKey="108175" VKey="99071" VRelease="r1" /><title text="The Oracle Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface." /></overlay><overlay disa="57" owner="disastig" ownerid="OL07-00-010110" ruleid="dconf_gnome_screensaver_lock_delay" severity="medium"><VMSinfo SVKey="108177" VKey="99073" VRelease="r1" /><title text="The Oracle Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated." /></overlay><overlay disa="192" owner="disastig" ownerid="OL07-00-010118" ruleid="accounts_password_pam_retry" severity="medium"><VMSinfo SVKey="108179" VKey="99075" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords." /></overlay><overlay disa="192" owner="disastig" ownerid="OL07-00-010119" ruleid="accounts_password_pam_retry" severity="medium"><VMSinfo SVKey="108181" VKey="99077" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used." /></overlay><overlay disa="192" owner="disastig" ownerid="OL07-00-010120" ruleid="accounts_password_pam_ucredit" severity="medium"><VMSinfo SVKey="108183" VKey="99079" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character." /></overlay><overlay disa="193" owner="disastig" ownerid="OL07-00-010130" ruleid="accounts_password_pam_lcredit" severity="medium"><VMSinfo SVKey="108185" VKey="99081" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character." /></overlay><overlay disa="194" owner="disastig" ownerid="OL07-00-010140" ruleid="accounts_password_pam_dcredit" severity="medium"><VMSinfo SVKey="108187" VKey="99083" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character." /></overlay><overlay disa="1619" owner="disastig" ownerid="OL07-00-010150" ruleid="accounts_password_pam_ocredit" severity="medium"><VMSinfo SVKey="108189" VKey="99085" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character." /></overlay><overlay disa="195" owner="disastig" ownerid="OL07-00-010160" ruleid="accounts_password_pam_difok" severity="medium"><VMSinfo SVKey="108191" VKey="99087" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed." /></overlay><overlay disa="195" owner="disastig" ownerid="OL07-00-010170" ruleid="accounts_password_pam_minclass" severity="medium"><VMSinfo SVKey="108193" VKey="99089" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed." /></overlay><overlay disa="195" owner="disastig" ownerid="OL07-00-010180" ruleid="accounts_password_pam_maxrepeat" severity="medium"><VMSinfo SVKey="108195" VKey="99091" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters." /></overlay><overlay disa="195" owner="disastig" ownerid="OL07-00-010190" ruleid="accounts_password_pam_maxclassrepeat" severity="medium"><VMSinfo SVKey="108197" VKey="99093" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters." /></overlay><overlay disa="196" owner="disastig" ownerid="OL07-00-010200" ruleid="set_password_hashing_algorithm_systemauth" severity="medium"><VMSinfo SVKey="108199" VKey="99095" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords." /></overlay><overlay disa="196" owner="disastig" ownerid="OL07-00-010210" ruleid="set_password_hashing_algorithm_logindefs" severity="medium"><VMSinfo SVKey="108201" VKey="99097" VRelease="r1" /><title text="The Oracle Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010219" ruleid="partition_for_var_log_audit" severity="low"><VMSinfo SVKey="108735" VKey="99631" VRelease="r1" /><title text="The Oracle Linux operating system must be integrated into a directory service infrastructure." /></overlay><overlay disa="196" owner="disastig" ownerid="OL07-00-010220" ruleid="set_password_hashing_algorithm_libuserconf" severity="medium"><VMSinfo SVKey="108203" VKey="99099" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords." /></overlay><overlay disa="198" owner="disastig" ownerid="OL07-00-010230" ruleid="accounts_minimum_age_login_defs" severity="medium"><VMSinfo SVKey="108205" VKey="99101" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime." /></overlay><overlay disa="198" owner="disastig" ownerid="OL07-00-010240" ruleid="accounts_password_set_min_life_existing" severity="medium"><VMSinfo SVKey="108207" VKey="99103" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime." /></overlay><overlay disa="199" owner="disastig" ownerid="OL07-00-010250" ruleid="accounts_maximum_age_login_defs" severity="medium"><VMSinfo SVKey="108209" VKey="99105" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime." /></overlay><overlay disa="199" owner="disastig" ownerid="OL07-00-010260" ruleid="accounts_password_set_max_life_existing" severity="medium"><VMSinfo SVKey="108211" VKey="99107" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime." /></overlay><overlay disa="200" owner="disastig" ownerid="OL07-00-010270" ruleid="accounts_password_pam_unix_remember" severity="medium"><VMSinfo SVKey="108213" VKey="99109" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations." /></overlay><overlay disa="205" owner="disastig" ownerid="OL07-00-010280" ruleid="accounts_password_pam_minlen" severity="medium"><VMSinfo SVKey="108215" VKey="99111" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that passwords are a minimum of 15 characters in length." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010290" ruleid="no_empty_passwords" severity="high"><VMSinfo SVKey="108217" VKey="99113" VRelease="r1" /><title text="The Oracle Linux operating system must not have accounts configured with blank or null passwords." /></overlay><overlay disa="766" owner="disastig" ownerid="OL07-00-010300" ruleid="sshd_disable_empty_passwords" severity="high"><VMSinfo SVKey="108219" VKey="99115" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password." /></overlay><overlay disa="795" owner="disastig" ownerid="OL07-00-010310" ruleid="account_disable_post_pw_expiration" severity="medium"><VMSinfo SVKey="108221" VKey="99117" VRelease="r1" /><title text="The Oracle Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires." /></overlay><overlay disa="2238" owner="disastig" ownerid="OL07-00-010320" ruleid="accounts_passwords_pam_faillock_deny" severity="medium"><VMSinfo SVKey="108223" VKey="99119" VRelease="r1" /><title text="Accounts on the Oracle Linux operating system subjected to three unsuccessful logon attempts within 15 minutes must be locked for the maximum configurable period." /></overlay><overlay disa="2238" owner="disastig" ownerid="OL07-00-010330" ruleid="accounts_passwords_pam_faillock_deny_root" severity="medium"><VMSinfo SVKey="108225" VKey="99121" VRelease="r1" /><title text="The Oracle Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period." /></overlay><overlay disa="2038" owner="disastig" ownerid="OL07-00-010340" ruleid="sudo_remove_nopasswd" severity="medium"><VMSinfo SVKey="108227" VKey="99123" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that users must provide a password for privilege escalation." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010430" ruleid="accounts_logon_fail_delay" severity="medium"><VMSinfo SVKey="108229" VKey="99125" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010440" ruleid="gnome_gdm_disable_automatic_login" severity="high"><VMSinfo SVKey="108231" VKey="99127" VRelease="r1" /><title text="The Oracle Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010450" ruleid="gnome_gdm_disable_guest_login" severity="high"><VMSinfo SVKey="108233" VKey="99129" VRelease="r1" /><title text="The Oracle Linux operating system must not allow an unrestricted logon to the system." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010460" ruleid="sshd_do_not_permit_user_env" severity="medium"><VMSinfo SVKey="108235" VKey="99131" VRelease="r1" /><title text="The Oracle Linux operating system must not allow users to override SSH environment variables." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-010470" ruleid="disable_host_auth" severity="medium"><VMSinfo SVKey="108237" VKey="99133" VRelease="r1" /><title text="The Oracle Linux operating system must not allow a non-certificate trusted host SSH logon to the system." /></overlay><overlay disa="213" owner="disastig" ownerid="OL07-00-010480" ruleid="grub2_password" severity="high"><VMSinfo SVKey="108239" VKey="99135" VRelease="r1" /><title text="Oracle Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes." /></overlay><overlay disa="213" owner="disastig" ownerid="OL07-00-010481" ruleid="require_singleuser_auth" severity="medium"><VMSinfo SVKey="108241" VKey="99137" VRelease="r1" /><title text="The Oracle Linux operating system must require authentication upon booting into single-user and maintenance modes." /></overlay><overlay disa="213" owner="disastig" ownerid="OL07-00-010482" ruleid="XXXX" severity="high"><VMSinfo SVKey="108243" VKey="99139" VRelease="r1" /><title text="Oracle Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes." /></overlay><overlay disa="213" owner="disastig" ownerid="OL07-00-010490" ruleid="grub2_uefi_password" severity="high"><VMSinfo SVKey="108245" VKey="99141" VRelease="r1" /><title text="Oracle Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes." /></overlay><overlay disa="213" owner="disastig" ownerid="OL07-00-010491" ruleid="XXXX" severity="high"><VMSinfo SVKey="108247" VKey="99143" VRelease="r1" /><title text="Oracle Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes." /></overlay><overlay disa="770" owner="disastig" ownerid="OL07-00-010500" ruleid="smartcard_auth" severity="medium"><VMSinfo SVKey="108249" VKey="99145" VRelease="r1" /><title text="The Oracle Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication." /></overlay><overlay disa="381" owner="disastig" ownerid="OL07-00-020000" ruleid="package_rsh-server_removed" severity="high"><VMSinfo SVKey="108251" VKey="99147" VRelease="r1" /><title text="The Oracle Linux operating system must not have the rsh-server package installed." /></overlay><overlay disa="381" owner="disastig" ownerid="OL07-00-020010" ruleid="package_ypserv_removed" severity="high"><VMSinfo SVKey="108253" VKey="99149" VRelease="r1" /><title text="The Oracle Linux operating system must not have the ypserv package installed." /></overlay><overlay disa="1233" owner="disastig" ownerid="OL07-00-020019" ruleid="XXXX" severity="medium"><VMSinfo SVKey="108255" VKey="99151" VRelease="r1" /><title text="The Oracle Linux operating system must have a host-based intrusion detection tool installed." /></overlay><overlay disa="2235" owner="disastig" ownerid="OL07-00-020020" ruleid="selinux_user_login_roles" severity="medium"><VMSinfo SVKey="108257" VKey="99153" VRelease="r1" /><title text="The Oracle Linux operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures." /></overlay><overlay disa="2699" owner="disastig" ownerid="OL07-00-020030" ruleid="aide_periodic_cron_checking" severity="medium"><VMSinfo SVKey="108259" VKey="99155" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly." /></overlay><overlay disa="1744" owner="disastig" ownerid="OL07-00-020040" ruleid="aide_scan_notification" severity="low"><VMSinfo SVKey="108261" VKey="99157" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that designated personnel are notified if baseline configurations are changed in an unauthorized manner." /></overlay><overlay disa="1749" owner="disastig" ownerid="OL07-00-020050" ruleid="ensure_gpgcheck_globally_activated" severity="high"><VMSinfo SVKey="108263" VKey="99159" VRelease="r1" /><title text="The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization." /></overlay><overlay disa="1749" owner="disastig" ownerid="OL07-00-020060" ruleid="ensure_gpgcheck_local_packages" severity="high"><VMSinfo SVKey="108265" VKey="99161" VRelease="r1" /><title text="The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization." /></overlay><overlay disa="778" owner="disastig" ownerid="OL07-00-020100" ruleid="kernel_module_usb-storage_disabled" severity="medium"><VMSinfo SVKey="108267" VKey="99163" VRelease="r1" /><title text="The Oracle Linux operating system must be configured to disable USB mass storage." /></overlay><overlay disa="1958" owner="disastig" ownerid="OL07-00-020101" ruleid="kernel_module_dccp_disabled" severity="medium"><VMSinfo SVKey="108269" VKey="99165" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required." /></overlay><overlay disa="778" owner="disastig" ownerid="OL07-00-020110" ruleid="service_autofs_disabled" severity="medium"><VMSinfo SVKey="108271" VKey="99167" VRelease="r1" /><title text="The Oracle Linux operating system must disable the file system automounter unless required." /></overlay><overlay disa="2617" owner="disastig" ownerid="OL07-00-020200" ruleid="clean_components_post_updating" severity="low"><VMSinfo SVKey="108273" VKey="99169" VRelease="r1" /><title text="The Oracle Linux operating system must remove all software components after updated versions have been installed." /></overlay><overlay disa="2696" owner="disastig" ownerid="OL07-00-020210" ruleid="selinux_state" severity="high"><VMSinfo SVKey="108643" VKey="99539" VRelease="r1" /><title text="The Oracle Linux operating system must enable SELinux." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020230" ruleid="disable_ctrlaltdel_reboot" severity="high"><VMSinfo SVKey="108275" VKey="99171" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020240" ruleid="accounts_umask_etc_login_defs" severity="medium"><VMSinfo SVKey="108277" VKey="99173" VRelease="r1" /><title text="The Oracle Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020250" ruleid="installed_OS_is_vendor_supported" severity="high"><VMSinfo SVKey="108279" VKey="99175" VRelease="r1" /><title text="The Oracle Linux operating system must be a vendor supported release." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020260" ruleid="security_patches_up_to_date" severity="medium"><VMSinfo SVKey="108281" VKey="99177" VRelease="r1" /><title text="The Oracle Linux operating system security patches and updates must be installed and up to date." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020270" ruleid="partition_for_var_log_audit" severity="medium"><VMSinfo SVKey="108283" VKey="99179" VRelease="r1" /><title text="The Oracle Linux operating system must not have unnecessary accounts." /></overlay><overlay disa="764" owner="disastig" ownerid="OL07-00-020300" ruleid="gid_passwd_group_same" severity="low"><VMSinfo SVKey="108285" VKey="99181" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020310" ruleid="accounts_no_uid_except_zero" severity="high"><VMSinfo SVKey="108289" VKey="99185" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020320" ruleid="no_files_unowned_by_user" severity="medium"><VMSinfo SVKey="108291" VKey="99187" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all files and directories have a valid owner." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020330" ruleid="file_permissions_ungroupowned" severity="medium"><VMSinfo SVKey="108293" VKey="99189" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all files and directories have a valid group owner." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020600" ruleid="accounts_user_interactive_home_directory_defined" severity="medium"><VMSinfo SVKey="108295" VKey="99191" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local interactive users have a home directory assigned in the /etc/passwd file." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020610" ruleid="accounts_have_homedir_login_defs" severity="medium"><VMSinfo SVKey="108297" VKey="99193" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020620" ruleid="accounts_user_interactive_home_directory_exists" severity="medium"><VMSinfo SVKey="108299" VKey="99195" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local interactive user home directories are defined in the /etc/passwd file." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020630" ruleid="file_permissions_home_directories" severity="medium"><VMSinfo SVKey="108301" VKey="99197" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020640" ruleid="file_ownership_home_directories" severity="medium"><VMSinfo SVKey="108303" VKey="99199" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local interactive user home directories are owned by their respective users." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020650" ruleid="file_groupownership_home_directories" severity="medium"><VMSinfo SVKey="108305" VKey="99201" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020660" ruleid="accounts_users_home_files_ownership" severity="medium"><VMSinfo SVKey="108307" VKey="99203" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories are owned by the owner of the home directory." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020670" ruleid="accounts_users_home_files_groupownership" severity="medium"><VMSinfo SVKey="108309" VKey="99205" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020680" ruleid="accounts_users_home_files_permissions" severity="medium"><VMSinfo SVKey="108311" VKey="99207" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020690" ruleid="accounts_user_dot_user_ownership" severity="medium"><VMSinfo SVKey="108313" VKey="99209" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020700" ruleid="accounts_user_dot_group_ownership" severity="medium"><VMSinfo SVKey="108315" VKey="99211" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020710" ruleid="file_permission_user_init_files" severity="medium"><VMSinfo SVKey="108317" VKey="99213" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020720" ruleid="accounts_user_home_paths_only" severity="medium"><VMSinfo SVKey="108319" VKey="99215" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020730" ruleid="accounts_user_dot_no_world_writable_programs" severity="medium"><VMSinfo SVKey="108321" VKey="99217" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that local initialization files do not execute world-writable programs." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-020900" ruleid="selinux_all_devicefiles_labeled" severity="medium"><VMSinfo SVKey="108323" VKey="99219" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021000" ruleid="mount_option_home_nosuid" severity="medium"><VMSinfo SVKey="108325" VKey="99221" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021010" ruleid="mount_option_nosuid_removable_partitions" severity="medium"><VMSinfo SVKey="108327" VKey="99223" VRelease="r1" /><title text="The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021020" ruleid="mount_option_nosuid_remote_filesystems" severity="medium"><VMSinfo SVKey="108329" VKey="99225" VRelease="r1" /><title text="The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS)." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021021" ruleid="mount_option_noexec_remote_filesystems" severity="medium"><VMSinfo SVKey="108331" VKey="99227" VRelease="r1" /><title text="The Oracle Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS)." /></overlay><overlay disa="1764" owner="disastig" ownerid="OL07-00-021022" ruleid="mount_option_dev_shm_nodev" severity="low"><VMSinfo SVKey="108333" VKey="99229" VRelease="r1" /><title text="The Oracle Linux operating system must mount /dev/shm with the nodev option." /></overlay><overlay disa="1764" owner="disastig" ownerid="OL07-00-021023" ruleid="mount_option_dev_shm_nosuid" severity="low"><VMSinfo SVKey="108335" VKey="99231" VRelease="r1" /><title text="The Oracle Linux operating system must mount /dev/shm with the nosuid option." /></overlay><overlay disa="1764" owner="disastig" ownerid="OL07-00-021024" ruleid="mount_option_dev_shm_noexec" severity="low"><VMSinfo SVKey="108337" VKey="99233" VRelease="r1" /><title text="The Oracle Linux operating system must mount /dev/shm with the noexec option." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021030" ruleid="dir_perms_world_writable_system_owned" severity="medium"><VMSinfo SVKey="108339" VKey="99235" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021040" ruleid="accounts_umask_interactive_users" severity="medium"><VMSinfo SVKey="108341" VKey="99237" VRelease="r1" /><title text="The Oracle Linux operating system must set the umask value to 077 for all local interactive user accounts." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021100" ruleid="rsyslog_cron_logging" severity="medium"><VMSinfo SVKey="108343" VKey="99239" VRelease="r1" /><title text="The Oracle Linux operating system must have cron logging implemented." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021110" ruleid="file_owner_cron_allow" severity="medium"><VMSinfo SVKey="108345" VKey="99241" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021120" ruleid="file_groupowner_cron_allow" severity="medium"><VMSinfo SVKey="108347" VKey="99243" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021300" ruleid="service_kdump_disabled" severity="medium"><VMSinfo SVKey="108349" VKey="99245" VRelease="r1" /><title text="The Oracle Linux operating system must disable Kernel core dumps unless needed." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021310" ruleid="partition_for_home" severity="low"><VMSinfo SVKey="108351" VKey="99247" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent)." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021320" ruleid="partition_for_var" severity="low"><VMSinfo SVKey="108353" VKey="99249" VRelease="r1" /><title text="The Oracle Linux operating system must use a separate file system for /var." /></overlay><overlay disa="1849" owner="disastig" ownerid="OL07-00-021330" ruleid="partition_for_var_log_audit" severity="low"><VMSinfo SVKey="108355" VKey="99251" VRelease="r1" /><title text="The Oracle Linux operating system must use a separate file system for the system audit data path large enough to hold at least one week of audit data." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021340" ruleid="partition_for_tmp" severity="low"><VMSinfo SVKey="108357" VKey="99253" VRelease="r1" /><title text="The Oracle Linux operating system must use a separate file system for /tmp (or equivalent)." /></overlay><overlay disa="2476" owner="disastig" ownerid="OL07-00-021350" ruleid="grub2_enable_fips_mode" severity="high"><VMSinfo SVKey="108359" VKey="99255" VRelease="r1" /><title text="The Oracle Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021600" ruleid="aide_verify_acls" severity="low"><VMSinfo SVKey="108361" VKey="99257" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs)." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021610" ruleid="aide_verify_ext_attributes" severity="low"><VMSinfo SVKey="108363" VKey="99259" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-021620" ruleid="aide_use_fips_hashes" severity="medium"><VMSinfo SVKey="108365" VKey="99261" VRelease="r1" /><title text="The Oracle Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories." /></overlay><overlay disa="1813" owner="disastig" ownerid="OL07-00-021700" ruleid="grub2_no_removeable_media" severity="medium"><VMSinfo SVKey="108367" VKey="99263" VRelease="r1" /><title text="The Oracle Linux operating system must not allow removable media to be used as the boot loader unless approved." /></overlay><overlay disa="381" owner="disastig" ownerid="OL07-00-021710" ruleid="package_telnet-server_removed" severity="high"><VMSinfo SVKey="108369" VKey="99265" VRelease="r1" /><title text="The Oracle Linux operating system must not have the telnet-server package installed." /></overlay><overlay disa="1814" owner="disastig" ownerid="OL07-00-030000" ruleid="service_auditd_enabled" severity="high"><VMSinfo SVKey="108371" VKey="99267" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users." /></overlay><overlay disa="140" owner="disastig" ownerid="OL07-00-030010" ruleid="audit_rules_system_shutdown" severity="medium"><VMSinfo SVKey="108373" VKey="99269" VRelease="r1" /><title text="The Oracle Linux operating system must shut down upon audit processing failure unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit processing failure." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030200" ruleid="auditd_name_format" severity="medium"><VMSinfo SVKey="108375" VKey="99271" VRelease="r1" /><title text="The Oracle Linux operating system must be configured to use the au-remote plugin." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030201" ruleid="auditd_name_format" severity="medium"><VMSinfo SVKey="108377" VKey="99273" VRelease="r1" /><title text="The Oracle Linux operating system must configure the au-remote plugin to off-load audit logs using the audisp-remote daemon." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030210" ruleid="auditd_name_format" severity="medium"><VMSinfo SVKey="108379" VKey="99275" VRelease="r1" /><title text="The Oracle Linux operating system must take appropriate action when the audisp-remote buffer is full." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030211" ruleid="auditd_name_format" severity="medium"><VMSinfo SVKey="108381" VKey="99277" VRelease="r1" /><title text="The Oracle Linux operating system must label all off-loaded audit logs before sending them to the central log server." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030300" ruleid="auditd_audispd_configure_remote_server" severity="medium"><VMSinfo SVKey="108383" VKey="99279" VRelease="r1" /><title text="The Oracle Linux operating system must off-load audit records onto a different system or media from the system being audited." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030310" ruleid="auditd_audispd_encrypt_sent_records" severity="medium"><VMSinfo SVKey="108385" VKey="99281" VRelease="r1" /><title text="The Oracle Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030320" ruleid="auditd_audispd_disk_full_action" severity="medium"><VMSinfo SVKey="108387" VKey="99283" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full." /></overlay><overlay disa="1851" owner="disastig" ownerid="OL07-00-030321" ruleid="auditd_audispd_network_failure_action" severity="medium"><VMSinfo SVKey="108389" VKey="99285" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system." /></overlay><overlay disa="1855" owner="disastig" ownerid="OL07-00-030330" ruleid="auditd_data_retention_space_left" severity="medium"><VMSinfo SVKey="108391" VKey="99287" VRelease="r1" /><title text="The Oracle Linux operating system must initiate an action to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity." /></overlay><overlay disa="1855" owner="disastig" ownerid="OL07-00-030340" ruleid="auditd_data_retention_space_left_action" severity="medium"><VMSinfo SVKey="108393" VKey="99289" VRelease="r1" /><title text="The Oracle Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached." /></overlay><overlay disa="1855" owner="disastig" ownerid="OL07-00-030350" ruleid="auditd_data_retention_action_mail_acct" severity="medium"><VMSinfo SVKey="108395" VKey="99291" VRelease="r1" /><title text="The Oracle Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached." /></overlay><overlay disa="2234" owner="disastig" ownerid="OL07-00-030360" ruleid="audit_rules_privileged_commands" severity="medium"><VMSinfo SVKey="108397" VKey="99293" VRelease="r1" /><title text="The Oracle Linux operating system must audit all executions of privileged functions." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030370" ruleid="audit_rules_dac_modification_chown" severity="medium"><VMSinfo SVKey="108399" VKey="99295" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the chown syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030380" ruleid="audit_rules_dac_modification_fchown" severity="medium"><VMSinfo SVKey="108401" VKey="99297" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the fchown syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030390" ruleid="audit_rules_dac_modification_lchown" severity="medium"><VMSinfo SVKey="108403" VKey="99299" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the lchown syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030400" ruleid="audit_rules_dac_modification_fchownat" severity="medium"><VMSinfo SVKey="108405" VKey="99301" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the fchownat syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030410" ruleid="audit_rules_dac_modification_chmod" severity="medium"><VMSinfo SVKey="108407" VKey="99303" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the chmod syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030420" ruleid="audit_rules_dac_modification_fchmod" severity="medium"><VMSinfo SVKey="108409" VKey="99305" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the fchmod syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030430" ruleid="audit_rules_dac_modification_fchmodat" severity="medium"><VMSinfo SVKey="108411" VKey="99307" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the fchmodat syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030440" ruleid="audit_rules_dac_modification_setxattr" severity="medium"><VMSinfo SVKey="108413" VKey="99309" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the setxattr syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030450" ruleid="audit_rules_dac_modification_fsetxattr" severity="medium"><VMSinfo SVKey="108415" VKey="99311" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the fsetxattr syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030460" ruleid="audit_rules_dac_modification_lsetxattr" severity="medium"><VMSinfo SVKey="108417" VKey="99313" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the lsetxattr syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030470" ruleid="audit_rules_dac_modification_removexattr" severity="medium"><VMSinfo SVKey="108419" VKey="99315" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the removexattr syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030480" ruleid="audit_rules_dac_modification_fremovexattr" severity="medium"><VMSinfo SVKey="108421" VKey="99317" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the fremovexattr syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030490" ruleid="audit_rules_dac_modification_lremovexattr" severity="medium"><VMSinfo SVKey="108423" VKey="99319" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the lremovexattr syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030500" ruleid="audit_rules_unsuccessful_file_modification_creat" severity="medium"><VMSinfo SVKey="108425" VKey="99321" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the creat syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030510" ruleid="audit_rules_unsuccessful_file_modification_open" severity="medium"><VMSinfo SVKey="108427" VKey="99323" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the open syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030520" ruleid="audit_rules_unsuccessful_file_modification_openat" severity="medium"><VMSinfo SVKey="108429" VKey="99325" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the openat syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030530" ruleid="audit_rules_unsuccessful_file_modification_open_by_handle_at" severity="medium"><VMSinfo SVKey="108431" VKey="99327" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the open_by_handle_at syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030540" ruleid="audit_rules_unsuccessful_file_modification_truncate" severity="medium"><VMSinfo SVKey="108433" VKey="99329" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the truncate syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030550" ruleid="audit_rules_unsuccessful_file_modification_ftruncate" severity="medium"><VMSinfo SVKey="108435" VKey="99331" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the ftruncate syscall." /></overlay><overlay disa="2884" owner="disastig" ownerid="OL07-00-030560" ruleid="audit_rules_execution_semanage" severity="medium"><VMSinfo SVKey="108437" VKey="99333" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the semanage command." /></overlay><overlay disa="2884" owner="disastig" ownerid="OL07-00-030570" ruleid="audit_rules_execution_setsebool" severity="medium"><VMSinfo SVKey="108439" VKey="99335" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the setsebool command." /></overlay><overlay disa="2884" owner="disastig" ownerid="OL07-00-030580" ruleid="audit_rules_execution_chcon" severity="medium"><VMSinfo SVKey="108441" VKey="99337" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the chcon command." /></overlay><overlay disa="2884" owner="disastig" ownerid="OL07-00-030590" ruleid="audit_rules_execution_setfiles" severity="medium"><VMSinfo SVKey="108443" VKey="99339" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the setfiles command." /></overlay><overlay disa="2884" owner="disastig" ownerid="OL07-00-030610" ruleid="audit_rules_login_events_faillock" severity="medium"><VMSinfo SVKey="108445" VKey="99341" VRelease="r1" /><title text="The Oracle Linux operating system must generate audit records for all unsuccessful account access events." /></overlay><overlay disa="2884" owner="disastig" ownerid="OL07-00-030620" ruleid="audit_rules_login_events_lastlog" severity="medium"><VMSinfo SVKey="108447" VKey="99343" VRelease="r1" /><title text="The Oracle Linux operating system must generate audit records for all successful account access events." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030630" ruleid="audit_rules_privileged_commands_passwd" severity="medium"><VMSinfo SVKey="108449" VKey="99345" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the passwd command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030640" ruleid="audit_rules_privileged_commands_unix_chkpwd" severity="medium"><VMSinfo SVKey="108451" VKey="99347" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the unix_chkpwd command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030650" ruleid="audit_rules_privileged_commands_gpasswd" severity="medium"><VMSinfo SVKey="108453" VKey="99349" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the gpasswd command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030660" ruleid="audit_rules_privileged_commands_chage" severity="medium"><VMSinfo SVKey="108455" VKey="99351" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the chage command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030670" ruleid="audit_rules_privileged_commands_userhelper" severity="medium"><VMSinfo SVKey="108457" VKey="99353" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the userhelper command." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030680" ruleid="audit_rules_privileged_commands_su" severity="medium"><VMSinfo SVKey="108459" VKey="99355" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the su command." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030690" ruleid="audit_rules_privileged_commands_sudo" severity="medium"><VMSinfo SVKey="108461" VKey="99357" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the sudo command." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030700" ruleid="audit_rules_sysadmin_actions" severity="medium"><VMSinfo SVKey="108463" VKey="99359" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030710" ruleid="audit_rules_privileged_commands_newgrp" severity="medium"><VMSinfo SVKey="108465" VKey="99361" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the newgrp command." /></overlay><overlay disa="130" owner="disastig" ownerid="OL07-00-030720" ruleid="audit_rules_privileged_commands_chsh" severity="medium"><VMSinfo SVKey="108467" VKey="99363" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the chsh command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030740" ruleid="audit_rules_media_export" severity="medium"><VMSinfo SVKey="108469" VKey="99365" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the mount command and syscall." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030750" ruleid="audit_rules_privileged_commands_umount" severity="medium"><VMSinfo SVKey="108471" VKey="99367" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the umount command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030760" ruleid="audit_rules_privileged_commands_postdrop" severity="medium"><VMSinfo SVKey="108473" VKey="99369" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the postdrop command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030770" ruleid="audit_rules_privileged_commands_postqueue" severity="medium"><VMSinfo SVKey="108475" VKey="99371" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the postqueue command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030780" ruleid="audit_rules_privileged_commands_ssh_keysign" severity="medium"><VMSinfo SVKey="108477" VKey="99373" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the ssh-keysign command." /></overlay><overlay disa="135" owner="disastig" ownerid="OL07-00-030800" ruleid="audit_rules_privileged_commands_crontab" severity="medium"><VMSinfo SVKey="108479" VKey="99375" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the crontab command." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030810" ruleid="audit_rules_privileged_commands_pam_timestamp_check" severity="medium"><VMSinfo SVKey="108481" VKey="99377" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the pam_timestamp_check command." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030819" ruleid="audit_rules_kernel_module_loading_init" severity="medium"><VMSinfo SVKey="108483" VKey="99379" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the create_module syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030820" ruleid="audit_rules_kernel_module_loading_init" severity="medium"><VMSinfo SVKey="108485" VKey="99381" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the init_module syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030821" ruleid="audit_rules_kernel_module_loading_finit" severity="medium"><VMSinfo SVKey="108487" VKey="99383" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the finit_module syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030830" ruleid="audit_rules_kernel_module_loading_delete" severity="medium"><VMSinfo SVKey="108489" VKey="99385" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the delete_module syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030840" ruleid="audit_rules_kernel_module_loading_init" severity="medium"><VMSinfo SVKey="108491" VKey="99387" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the kmod command." /></overlay><overlay disa="2130" owner="disastig" ownerid="OL07-00-030870" ruleid="audit_rules_usergroup_modification_passwd" severity="medium"><VMSinfo SVKey="108493" VKey="99389" VRelease="r1" /><title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd." /></overlay><overlay disa="18" owner="disastig" ownerid="OL07-00-030871" ruleid="audit_rules_usergroup_modification_group" severity="medium"><VMSinfo SVKey="108495" VKey="99391" VRelease="r1" /><title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group." /></overlay><overlay disa="18" owner="disastig" ownerid="OL07-00-030872" ruleid="audit_rules_usergroup_modification_gshadow" severity="medium"><VMSinfo SVKey="108497" VKey="99393" VRelease="r1" /><title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow." /></overlay><overlay disa="18" owner="disastig" ownerid="OL07-00-030873" ruleid="audit_rules_usergroup_modification_shadow" severity="medium"><VMSinfo SVKey="108499" VKey="99395" VRelease="r1" /><title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow." /></overlay><overlay disa="18" owner="disastig" ownerid="OL07-00-030874" ruleid="audit_rules_usergroup_modification_opasswd" severity="medium"><VMSinfo SVKey="108501" VKey="99397" VRelease="r1" /><title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030880" ruleid="audit_rules_file_deletion_events_rename" severity="medium"><VMSinfo SVKey="108503" VKey="99399" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the rename syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030890" ruleid="audit_rules_file_deletion_events_renameat" severity="medium"><VMSinfo SVKey="108505" VKey="99401" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the renameat syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030900" ruleid="audit_rules_file_deletion_events_rmdir" severity="medium"><VMSinfo SVKey="108507" VKey="99403" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the rmdir syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030910" ruleid="audit_rules_file_deletion_events_unlink" severity="medium"><VMSinfo SVKey="108509" VKey="99405" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the unlink syscall." /></overlay><overlay disa="172" owner="disastig" ownerid="OL07-00-030920" ruleid="audit_rules_file_deletion_events_unlinkat" severity="medium"><VMSinfo SVKey="108511" VKey="99407" VRelease="r1" /><title text="The Oracle Linux operating system must audit all uses of the unlinkat syscall." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-031000" ruleid="rsyslog_remote_loghost" severity="medium"><VMSinfo SVKey="108513" VKey="99409" VRelease="r1" /><title text="The Oracle Linux operating system must send rsyslog output to a log aggregation server." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-031010" ruleid="rsyslog_nolisten" severity="medium"><VMSinfo SVKey="108515" VKey="99411" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-032000" ruleid="install_mcafee_antivirus" severity="high"><VMSinfo SVKey="108517" VKey="99413" VRelease="r1" /><title text="The Oracle Linux operating system must use a virus scan program." /></overlay><overlay disa="54" owner="disastig" ownerid="OL07-00-040000" ruleid="accounts_max_concurrent_login_sessions" severity="low"><VMSinfo SVKey="108519" VKey="99415" VRelease="r1" /><title text="The Oracle Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types." /></overlay><overlay disa="2314" owner="disastig" ownerid="OL07-00-040100" ruleid="configure_firewalld_ports" severity="medium"><VMSinfo SVKey="108521" VKey="99417" VRelease="r1" /><title text="The Oracle Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments." /></overlay><overlay disa="3123" owner="disastig" ownerid="OL07-00-040110" ruleid="sshd_use_approved_ciphers" severity="medium"><VMSinfo SVKey="108523" VKey="99419" VRelease="r1" /><title text="The Oracle Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications." /></overlay><overlay disa="1133" owner="disastig" ownerid="OL07-00-040160" ruleid="accounts_tmout" severity="medium"><VMSinfo SVKey="108525" VKey="99421" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except to fulfill documented and validated mission requirements." /></overlay><overlay disa="48" owner="disastig" ownerid="OL07-00-040170" ruleid="sshd_enable_warning_banner" severity="medium"><VMSinfo SVKey="108527" VKey="99423" VRelease="r1" /><title text="The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts." /></overlay><overlay disa="1453" owner="disastig" ownerid="OL07-00-040180" ruleid="sssd_ldap_start_tls" severity="medium"><VMSinfo SVKey="108529" VKey="99425" VRelease="r1" /><title text="The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications." /></overlay><overlay disa="1453" owner="disastig" ownerid="OL07-00-040190" ruleid="sssd_ldap_configure_tls_ca_dir" severity="medium"><VMSinfo SVKey="108531" VKey="99427" VRelease="r1" /><title text="The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications." /></overlay><overlay disa="1453" owner="disastig" ownerid="OL07-00-040200" ruleid="sssd_ldap_configure_tls_ca" severity="medium"><VMSinfo SVKey="108533" VKey="99429" VRelease="r1" /><title text="The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications." /></overlay><overlay disa="2824" owner="disastig" ownerid="OL07-00-040201" ruleid="sysctl_kernel_randomize_va_space" severity="medium"><VMSinfo SVKey="108535" VKey="99431" VRelease="r1" /><title text="The Oracle Linux operating system must implement virtual address space randomization." /></overlay><overlay disa="2422" owner="disastig" ownerid="OL07-00-040300" ruleid="package_openssh-server_installed" severity="medium"><VMSinfo SVKey="108537" VKey="99433" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all networked systems have SSH installed." /></overlay><overlay disa="2418" owner="disastig" ownerid="OL07-00-040310" ruleid="service_sshd_enabled" severity="medium"><VMSinfo SVKey="108539" VKey="99435" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission." /></overlay><overlay disa="2361" owner="disastig" ownerid="OL07-00-040320" ruleid="sshd_set_idle_timeout" severity="medium"><VMSinfo SVKey="108541" VKey="99437" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission requirements." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040330" ruleid="sshd_disable_rhosts_rsa" severity="medium"><VMSinfo SVKey="108543" VKey="99439" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication." /></overlay><overlay disa="1133" owner="disastig" ownerid="OL07-00-040340" ruleid="sshd_set_keepalive" severity="medium"><VMSinfo SVKey="108545" VKey="99441" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040350" ruleid="sshd_disable_rhosts" severity="medium"><VMSinfo SVKey="108547" VKey="99443" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040360" ruleid="sshd_print_last_log" severity="medium"><VMSinfo SVKey="108549" VKey="99445" VRelease="r1" /><title text="The Oracle Linux operating system must display the date and time of the last successful account logon upon an SSH logon." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040370" ruleid="sshd_disable_root_login" severity="medium"><VMSinfo SVKey="108551" VKey="99447" VRelease="r1" /><title text="The Oracle Linux operating system must not permit direct logons to the root account using remote access via SSH." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040380" ruleid="sshd_disable_user_known_hosts" severity="medium"><VMSinfo SVKey="108553" VKey="99449" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication." /></overlay><overlay disa="197" owner="disastig" ownerid="OL07-00-040390" ruleid="sshd_allow_only_protocol2" severity="high"><VMSinfo SVKey="108555" VKey="99451" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol." /></overlay><overlay disa="1453" owner="disastig" ownerid="OL07-00-040400" ruleid="sshd_use_approved_macs" severity="medium"><VMSinfo SVKey="108557" VKey="99453" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040410" ruleid="file_permissions_sshd_pub_key" severity="medium"><VMSinfo SVKey="108559" VKey="99455" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040420" ruleid="file_permissions_sshd_private_key" severity="medium"><VMSinfo SVKey="108561" VKey="99457" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive." /></overlay><overlay disa="1813" owner="disastig" ownerid="OL07-00-040430" ruleid="sshd_disable_gssapi_auth" severity="medium"><VMSinfo SVKey="108563" VKey="99459" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed." /></overlay><overlay disa="1813" owner="disastig" ownerid="OL07-00-040440" ruleid="sshd_disable_kerb_auth" severity="medium"><VMSinfo SVKey="108565" VKey="99461" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040450" ruleid="sshd_enable_strictmodes" severity="medium"><VMSinfo SVKey="108567" VKey="99463" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040460" ruleid="sshd_use_priv_separation" severity="medium"><VMSinfo SVKey="108569" VKey="99465" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon uses privilege separation." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040470" ruleid="sshd_disable_compression" severity="medium"><VMSinfo SVKey="108571" VKey="99467" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication." /></overlay><overlay disa="2468" owner="disastig" ownerid="OL07-00-040480" ruleid="XXXX" severity="medium"><VMSinfo SVKey="108573" VKey="99469" VRelease="r1" /><title text="The operating system must request and perform data origin authentication verification and data integrity verification on the name/address resolution responses the system receives from authoritative sources." /></overlay><overlay disa="2046" owner="disastig" ownerid="OL07-00-040500" ruleid="chronyd_or_ntpd_set_maxpoll" severity="medium"><VMSinfo SVKey="108575" VKey="99471" VRelease="r1" /><title text="The Oracle Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS)." /></overlay><overlay disa="2385" owner="disastig" ownerid="OL07-00-040510" ruleid="sysctl_net_ipv4_tcp_invalid_ratelimit" severity="medium"><VMSinfo SVKey="108577" VKey="99473" VRelease="r1" /><title text="The Oracle Linux operating system must protect against or limit the effects of Denial of Service (DoS) attacks by validating the operating system is implementing rate-limiting measures on impacted network interfaces." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040520" ruleid="service_firewalld_enabled" severity="medium"><VMSinfo SVKey="108579" VKey="99475" VRelease="r1" /><title text="The Oracle Linux operating system must enable an application firewall, if available." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040530" ruleid="display_login_attempts" severity="low"><VMSinfo SVKey="108581" VKey="99477" VRelease="r1" /><title text="The Oracle Linux operating system must display the date and time of the last successful account logon upon logon." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040540" ruleid="no_user_host_based_files" severity="high"><VMSinfo SVKey="108583" VKey="99479" VRelease="r1" /><title text="The Oracle Linux operating system must not contain .shosts files." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040550" ruleid="no_host_based_files" severity="high"><VMSinfo SVKey="108585" VKey="99481" VRelease="r1" /><title text="The Oracle Linux operating system must not contain shosts.equiv files." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040600" ruleid="network_configure_name_resolution" severity="low"><VMSinfo SVKey="108587" VKey="99483" VRelease="r1" /><title text="At least two name servers must be configured for Oracle Linux operating systems using DNS resolution." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040610" ruleid="sysctl_net_ipv4_conf_all_accept_source_route" severity="medium"><VMSinfo SVKey="108589" VKey="99485" VRelease="r1" /><title text="The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040611" ruleid="sysctl_net_ipv4_conf_all_rp_filter" severity="medium"><VMSinfo SVKey="108591" VKey="99487" VRelease="r1" /><title text="The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040612" ruleid="sysctl_net_ipv4_conf_default_rp_filter" severity="medium"><VMSinfo SVKey="108593" VKey="99489" VRelease="r1" /><title text="The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040620" ruleid="sysctl_net_ipv4_conf_default_accept_source_route" severity="medium"><VMSinfo SVKey="108595" VKey="99491" VRelease="r1" /><title text="The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040630" ruleid="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" severity="medium"><VMSinfo SVKey="108597" VKey="99493" VRelease="r1" /><title text="The Oracle Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040640" ruleid="sysctl_net_ipv4_conf_default_accept_redirects" severity="medium"><VMSinfo SVKey="108599" VKey="99495" VRelease="r1" /><title text="The Oracle Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040641" ruleid="sysctl_net_ipv4_conf_all_accept_redirects" severity="medium"><VMSinfo SVKey="108601" VKey="99497" VRelease="r1" /><title text="The Oracle Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040650" ruleid="sysctl_net_ipv4_conf_default_send_redirects" severity="medium"><VMSinfo SVKey="108603" VKey="99499" VRelease="r1" /><title text="The Oracle Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040660" ruleid="sysctl_net_ipv4_conf_all_send_redirects" severity="medium"><VMSinfo SVKey="108605" VKey="99501" VRelease="r1" /><title text="The Oracle Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040670" ruleid="network_sniffer_disabled" severity="medium"><VMSinfo SVKey="108607" VKey="99503" VRelease="r1" /><title text="Network interfaces configured on The Oracle Linux operating system must not be in promiscuous mode." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040680" ruleid="postfix_prevent_unrestricted_relay" severity="medium"><VMSinfo SVKey="108609" VKey="99505" VRelease="r1" /><title text="The Oracle Linux operating system must be configured to prevent unrestricted mail relaying." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040690" ruleid="package_vsftpd_removed" severity="high"><VMSinfo SVKey="108611" VKey="99507" VRelease="r1" /><title text="The Oracle Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040700" ruleid="package_tftp-server_removed" severity="high"><VMSinfo SVKey="108613" VKey="99509" VRelease="r1" /><title text="The Oracle Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040710" ruleid="sshd_enable_x11_forwarding" severity="high"><VMSinfo SVKey="108615" VKey="99511" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that remote X connections for interactive users are encrypted." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040720" ruleid="tftpd_uses_secure_mode" severity="medium"><VMSinfo SVKey="108617" VKey="99513" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040730" ruleid="package_xorg-x11-server-common_removed" severity="medium"><VMSinfo SVKey="108619" VKey="99515" VRelease="r1" /><title text="The Oracle Linux operating system must not have an X Windows display manager installed unless approved." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040740" ruleid="sysctl_net_ipv4_ip_forward" severity="medium"><VMSinfo SVKey="108621" VKey="99517" VRelease="r1" /><title text="The Oracle Linux operating system must not be performing packet forwarding unless the system is a router." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040750" ruleid="mount_option_krb_sec_remote_filesystems" severity="medium"><VMSinfo SVKey="108623" VKey="99519" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040800" ruleid="snmpd_not_default_password" severity="high"><VMSinfo SVKey="108625" VKey="99521" VRelease="r1" /><title text="SNMP community strings on the Oracle Linux operating system must be changed from the default." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040810" ruleid="set_firewalld_default_zone" severity="medium"><VMSinfo SVKey="108627" VKey="99523" VRelease="r1" /><title text="The Oracle Linux operating system access control program must be configured to grant or deny system access to specific hosts and services." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040820" ruleid="libreswan_approved_tunnels" severity="medium"><VMSinfo SVKey="108629" VKey="99525" VRelease="r1" /><title text="The Oracle Linux operating system must not have unauthorized IP tunnels configured." /></overlay><overlay disa="366" owner="disastig" ownerid="OL07-00-040830" ruleid="sysctl_net_ipv6_conf_all_accept_source_route" severity="medium"><VMSinfo SVKey="108631" VKey="99527" VRelease="r1" /><title text="The Oracle Linux operating system must not forward IPv6 source-routed packets." /></overlay><overlay disa="1953" owner="disastig" ownerid="OL07-00-041001" ruleid="install_smartcard_packages" severity="medium"><VMSinfo SVKey="108633" VKey="99529" VRelease="r1" /><title text="The Oracle Linux operating system must have the required packages for multifactor authentication installed." /></overlay><overlay disa="1954" owner="disastig" ownerid="OL07-00-041002" ruleid="sssd_enable_pam_services" severity="medium"><VMSinfo SVKey="108635" VKey="99531" VRelease="r1" /><title text="The Oracle Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM)." /></overlay><overlay disa="1954" owner="disastig" ownerid="OL07-00-041003" ruleid="smartcard_configure_cert_checking" severity="medium"><VMSinfo SVKey="108637" VKey="99533" VRelease="r1" /><title text="The Oracle Linux operating system must implement certificate status checking for PKI authentication." /></overlay><overlay disa="2421" owner="disastig" ownerid="OL07-00-041010" ruleid="wireless_disable_interfaces" severity="medium"><VMSinfo SVKey="108639" VKey="99535" VRelease="r1" /><title text="The Oracle Linux operating system must be configured so that all wireless network adapters are disabled." /></overlay><overlay disa="1314" owner="disastig" ownerid="OL07-00-910055" ruleid="file_permissions_var_log_audit" severity="medium"><VMSinfo SVKey="108641" VKey="99537" VRelease="r1" /><title text="The Oracle Linux operating system must protect audit information from unauthorized read, modification, or deletion." /></overlay></overlays> -\ No newline at end of file -+<?xml version="1.0" encoding="UTF-8"?> -+<overlays xmlns="http://checklists.nist.gov/xccdf/1.1"> -+ <overlay owner="disastig" ruleid="rpm_verify_ownership" ownerid="OL07-00-010010" disa="1496" severity="high"> -+ <VMSinfo VKey="221652" SVKey="221652r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="rpm_verify_hashes" ownerid="OL07-00-010020" disa="1749" severity="high"> -+ <VMSinfo VKey="221653" SVKey="221653r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_banner_enabled" ownerid="OL07-00-010030" disa="1388" severity="medium"> -+ <VMSinfo VKey="221654" SVKey="221654r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_login_banner_text" ownerid="OL07-00-010040" disa="48" severity="medium"> -+ <VMSinfo VKey="221655" SVKey="221655r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="banner_etc_issue" ownerid="OL07-00-010050" disa="48" severity="medium"> -+ <VMSinfo VKey="221656" SVKey="221656r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_screensaver_lock_enabled" ownerid="OL07-00-010060" disa="56" severity="medium"> -+ <VMSinfo VKey="221657" SVKey="221657r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_enable_smartcard_auth" ownerid="OL07-00-010061" disa="1948" severity="medium"> -+ <VMSinfo VKey="221658" SVKey="221658r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_screensaver_lock_locked" ownerid="OL07-00-010062" disa="57" severity="medium"> -+ <VMSinfo VKey="221659" SVKey="221659r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_screensaver_idle_delay" ownerid="OL07-00-010070" disa="57" severity="medium"> -+ <VMSinfo VKey="221660" SVKey="221660r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_screensaver_user_locks" ownerid="OL07-00-010081" disa="57" severity="medium"> -+ <VMSinfo VKey="221661" SVKey="221661r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_session_idle_user_locks" ownerid="OL07-00-010082" disa="57" severity="medium"> -+ <VMSinfo VKey="221662" SVKey="221662r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_screensaver_idle_activation_enabled" ownerid="OL07-00-010100" disa="57" severity="medium"> -+ <VMSinfo VKey="221664" SVKey="221664r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_screensaver_idle_activation_locked" ownerid="OL07-00-010101" disa="57" severity="medium"> -+ <VMSinfo VKey="221665" SVKey="221665r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_screensaver_lock_delay" ownerid="OL07-00-010110" disa="57" severity="medium"> -+ <VMSinfo VKey="221666" SVKey="221666r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="OL07-00-010118" disa="192" severity="medium"> -+ <VMSinfo VKey="221667" SVKey="221667r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_retry" ownerid="OL07-00-010119" disa="192" severity="medium"> -+ <VMSinfo VKey="221668" SVKey="221668r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_ucredit" ownerid="OL07-00-010120" disa="192" severity="medium"> -+ <VMSinfo VKey="221669" SVKey="221669r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_lcredit" ownerid="OL07-00-010130" disa="193" severity="medium"> -+ <VMSinfo VKey="221670" SVKey="221670r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_dcredit" ownerid="OL07-00-010140" disa="194" severity="medium"> -+ <VMSinfo VKey="221671" SVKey="221671r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_ocredit" ownerid="OL07-00-010150" disa="1619" severity="medium"> -+ <VMSinfo VKey="221672" SVKey="221672r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_difok" ownerid="OL07-00-010160" disa="195" severity="medium"> -+ <VMSinfo VKey="221673" SVKey="221673r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_minclass" ownerid="OL07-00-010170" disa="195" severity="medium"> -+ <VMSinfo VKey="221674" SVKey="221674r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_maxrepeat" ownerid="OL07-00-010180" disa="195" severity="medium"> -+ <VMSinfo VKey="221675" SVKey="221675r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_maxclassrepeat" ownerid="OL07-00-010190" disa="195" severity="medium"> -+ <VMSinfo VKey="221676" SVKey="221676r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="set_password_hashing_algorithm_systemauth" ownerid="OL07-00-010200" disa="196" severity="medium"> -+ <VMSinfo VKey="221677" SVKey="221677r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="set_password_hashing_algorithm_logindefs" ownerid="OL07-00-010210" disa="196" severity="medium"> -+ <VMSinfo VKey="221678" SVKey="221678r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="set_password_hashing_algorithm_libuserconf" ownerid="OL07-00-010220" disa="196" severity="medium"> -+ <VMSinfo VKey="221680" SVKey="221680r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_minimum_age_login_defs" ownerid="OL07-00-010230" disa="198" severity="medium"> -+ <VMSinfo VKey="221681" SVKey="221681r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_set_min_life_existing" ownerid="OL07-00-010240" disa="198" severity="medium"> -+ <VMSinfo VKey="221682" SVKey="221682r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_maximum_age_login_defs" ownerid="OL07-00-010250" disa="199" severity="medium"> -+ <VMSinfo VKey="221683" SVKey="221683r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_set_max_life_existing" ownerid="OL07-00-010260" disa="199" severity="medium"> -+ <VMSinfo VKey="221684" SVKey="221684r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_unix_remember" ownerid="OL07-00-010270" disa="200" severity="medium"> -+ <VMSinfo VKey="221685" SVKey="221685r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_password_pam_minlen" ownerid="OL07-00-010280" disa="205" severity="medium"> -+ <VMSinfo VKey="221686" SVKey="221686r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that passwords are a minimum of 15 characters in length."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="no_empty_passwords" ownerid="OL07-00-010290" disa="366" severity="high"> -+ <VMSinfo VKey="221687" SVKey="221687r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have accounts configured with blank or null passwords."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_empty_passwords" ownerid="OL07-00-010300" disa="766" severity="high"> -+ <VMSinfo VKey="221688" SVKey="221688r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="account_disable_post_pw_expiration" ownerid="OL07-00-010310" disa="795" severity="medium"> -+ <VMSinfo VKey="221689" SVKey="221689r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_passwords_pam_faillock_deny" ownerid="OL07-00-010320" disa="44" severity="medium"> -+ <VMSinfo VKey="221690" SVKey="221690r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured to lock accounts for a minimum of 15 minutes after three unsuccessful logon attempts within a 15-minute timeframe."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_passwords_pam_faillock_deny_root" ownerid="OL07-00-010330" disa="2238" severity="medium"> -+ <VMSinfo VKey="221691" SVKey="221691r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sudo_remove_nopasswd" ownerid="OL07-00-010340" disa="2038" severity="medium"> -+ <VMSinfo VKey="221692" SVKey="221692r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that users must provide a password for privilege escalation."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sudo_remove_no_authenticate" ownerid="OL07-00-010350" disa="2038" severity="medium"> -+ <VMSinfo VKey="228569" SVKey="228569r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so users must re-authenticate for privilege escalation."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_logon_fail_delay" ownerid="OL07-00-010430" disa="366" severity="medium"> -+ <VMSinfo VKey="221693" SVKey="221693r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="gnome_gdm_disable_automatic_login" ownerid="OL07-00-010440" disa="366" severity="high"> -+ <VMSinfo VKey="221694" SVKey="221694r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="gnome_gdm_disable_guest_login" ownerid="OL07-00-010450" disa="366" severity="high"> -+ <VMSinfo VKey="221695" SVKey="221695r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not allow an unrestricted logon to the system."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_do_not_permit_user_env" ownerid="OL07-00-010460" disa="366" severity="medium"> -+ <VMSinfo VKey="221696" SVKey="221696r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not allow users to override SSH environment variables."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="disable_host_auth" ownerid="OL07-00-010470" disa="366" severity="medium"> -+ <VMSinfo VKey="221697" SVKey="221697r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not allow a non-certificate trusted host SSH logon to the system."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="grub2_password" ownerid="OL07-00-010480" disa="213" severity="high"> -+ <VMSinfo VKey="221698" SVKey="221698r5059" VRelease="r505922"/> -+ <title text="Oracle Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="require_singleuser_auth" ownerid="OL07-00-010481" disa="213" severity="medium"> -+ <VMSinfo VKey="221699" SVKey="221699r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must require authentication upon booting into single-user and maintenance modes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="OL07-00-010482" disa="213" severity="high"> -+ <VMSinfo VKey="221700" SVKey="221700r5059" VRelease="r505922"/> -+ <title text="Oracle Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="grub2_uefi_password" ownerid="OL07-00-010490" disa="213" severity="high"> -+ <VMSinfo VKey="221701" SVKey="221701r5059" VRelease="r505922"/> -+ <title text="Oracle Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="OL07-00-010491" disa="213" severity="high"> -+ <VMSinfo VKey="221702" SVKey="221702r5059" VRelease="r505922"/> -+ <title text="Oracle Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="smartcard_auth" ownerid="OL07-00-010500" disa="764" severity="medium"> -+ <VMSinfo VKey="221703" SVKey="221703r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="package_rsh-server_removed" ownerid="OL07-00-020000" disa="381" severity="high"> -+ <VMSinfo VKey="221704" SVKey="221704r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have the rsh-server package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="package_ypserv_removed" ownerid="OL07-00-020010" disa="381" severity="high"> -+ <VMSinfo VKey="221705" SVKey="221705r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have the ypserv package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="OL07-00-020019" disa="1233" severity="medium"> -+ <VMSinfo VKey="221706" SVKey="221706r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must have a host-based intrusion detection tool installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="selinux_user_login_roles" ownerid="OL07-00-020020" disa="2235" severity="medium"> -+ <VMSinfo VKey="221707" SVKey="221707r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="aide_periodic_cron_checking" ownerid="OL07-00-020030" disa="2699" severity="medium"> -+ <VMSinfo VKey="221708" SVKey="221708r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="aide_scan_notification" ownerid="OL07-00-020040" disa="1744" severity="medium"> -+ <VMSinfo VKey="221709" SVKey="221709r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that designated personnel are notified if baseline configurations are changed in an unauthorized manner."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="ensure_gpgcheck_globally_activated" ownerid="OL07-00-020050" disa="1749" severity="high"> -+ <VMSinfo VKey="221710" SVKey="221710r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="ensure_gpgcheck_local_packages" ownerid="OL07-00-020060" disa="1749" severity="high"> -+ <VMSinfo VKey="221711" SVKey="221711r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="kernel_module_usb-storage_disabled" ownerid="OL07-00-020100" disa="1958" severity="medium"> -+ <VMSinfo VKey="221712" SVKey="221712r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured to disable USB mass storage."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="kernel_module_dccp_disabled" ownerid="OL07-00-020101" disa="1958" severity="medium"> -+ <VMSinfo VKey="221713" SVKey="221713r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="service_autofs_disabled" ownerid="OL07-00-020110" disa="778" severity="medium"> -+ <VMSinfo VKey="221714" SVKey="221714r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must disable the file system automounter unless required."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="kernel_module_usb-storage_disabled" ownerid="OL07-00-020111" disa="1958" severity="medium"> -+ <VMSinfo VKey="228567" SVKey="228567r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must disable the graphical user interface automounter unless required."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="clean_components_post_updating" ownerid="OL07-00-020200" disa="2617" severity="low"> -+ <VMSinfo VKey="221715" SVKey="221715r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must remove all software components after updated versions have been installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="selinux_state" ownerid="OL07-00-020210" disa="2165" severity="medium"> -+ <VMSinfo VKey="221716" SVKey="221716r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must enable SELinux."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="selinux_policytype" ownerid="OL07-00-020220" disa="2165" severity="medium"> -+ <VMSinfo VKey="228570" SVKey="228570r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must enable the SELinux targeted policy."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="disable_ctrlaltdel_reboot" ownerid="OL07-00-020230" disa="366" severity="high"> -+ <VMSinfo VKey="221717" SVKey="221717r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled on the command line."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dconf_gnome_disable_ctrlaltdel_reboot" ownerid="OL07-00-020231" disa="366" severity="high"> -+ <VMSinfo VKey="228565" SVKey="228565r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so the x86 Ctrl-Alt-Delete key sequence is disabled in the Graphical User Interface."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_umask_etc_login_defs" ownerid="OL07-00-020240" disa="366" severity="medium"> -+ <VMSinfo VKey="221718" SVKey="221718r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="installed_OS_is_vendor_supported" ownerid="OL07-00-020250" disa="366" severity="high"> -+ <VMSinfo VKey="221719" SVKey="221719r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be a vendor supported release."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="security_patches_up_to_date" ownerid="OL07-00-020260" disa="366" severity="medium"> -+ <VMSinfo VKey="221720" SVKey="221720r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system security patches and updates must be installed and up to date."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_root_login" ownerid="OL07-00-020270" disa="366" severity="medium"> -+ <VMSinfo VKey="221721" SVKey="221721r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have unnecessary accounts."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="gid_passwd_group_same" ownerid="OL07-00-020300" disa="764" severity="low"> -+ <VMSinfo VKey="221722" SVKey="221722r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_no_uid_except_zero" ownerid="OL07-00-020310" disa="366" severity="high"> -+ <VMSinfo VKey="221723" SVKey="221723r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="no_files_unowned_by_user" ownerid="OL07-00-020320" disa="366" severity="medium"> -+ <VMSinfo VKey="221724" SVKey="221724r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all files and directories have a valid owner."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_permissions_ungroupowned" ownerid="OL07-00-020330" disa="366" severity="medium"> -+ <VMSinfo VKey="221725" SVKey="221725r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all files and directories have a valid group owner."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_have_homedir_login_defs" ownerid="OL07-00-020610" disa="366" severity="medium"> -+ <VMSinfo VKey="221727" SVKey="221727r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_user_interactive_home_directory_exists" ownerid="OL07-00-020620" disa="366" severity="medium"> -+ <VMSinfo VKey="221728" SVKey="221728r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local interactive users have a home directory assigned and defined in the /etc/passwd file."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_permissions_home_directories" ownerid="OL07-00-020630" disa="366" severity="medium"> -+ <VMSinfo VKey="221729" SVKey="221729r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_ownership_home_directories" ownerid="OL07-00-020640" disa="366" severity="medium"> -+ <VMSinfo VKey="221730" SVKey="221730r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local interactive user home directories are owned by their respective users."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_groupownership_home_directories" ownerid="OL07-00-020650" disa="366" severity="medium"> -+ <VMSinfo VKey="221731" SVKey="221731r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_users_home_files_ownership" ownerid="OL07-00-020660" disa="366" severity="medium"> -+ <VMSinfo VKey="221732" SVKey="221732r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories are owned by the owner of the home directory."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_users_home_files_groupownership" ownerid="OL07-00-020670" disa="366" severity="medium"> -+ <VMSinfo VKey="221733" SVKey="221733r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_users_home_files_permissions" ownerid="OL07-00-020680" disa="366" severity="medium"> -+ <VMSinfo VKey="221734" SVKey="221734r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_user_dot_user_ownership" ownerid="OL07-00-020690" disa="366" severity="medium"> -+ <VMSinfo VKey="221735" SVKey="221735r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_user_dot_group_ownership" ownerid="OL07-00-020700" disa="366" severity="medium"> -+ <VMSinfo VKey="221736" SVKey="221736r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_permission_user_init_files" ownerid="OL07-00-020710" disa="366" severity="medium"> -+ <VMSinfo VKey="221737" SVKey="221737r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_user_home_paths_only" ownerid="OL07-00-020720" disa="366" severity="medium"> -+ <VMSinfo VKey="221738" SVKey="221738r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_user_dot_no_world_writable_programs" ownerid="OL07-00-020730" disa="366" severity="medium"> -+ <VMSinfo VKey="221739" SVKey="221739r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that local initialization files do not execute world-writable programs."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="selinux_all_devicefiles_labeled" ownerid="OL07-00-020900" disa="366" severity="medium"> -+ <VMSinfo VKey="221740" SVKey="221740r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="mount_option_home_nosuid" ownerid="OL07-00-021000" disa="366" severity="medium"> -+ <VMSinfo VKey="221741" SVKey="221741r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="mount_option_nosuid_removable_partitions" ownerid="OL07-00-021010" disa="366" severity="medium"> -+ <VMSinfo VKey="221742" SVKey="221742r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="mount_option_nosuid_remote_filesystems" ownerid="OL07-00-021020" disa="366" severity="medium"> -+ <VMSinfo VKey="221743" SVKey="221743r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="mount_option_noexec_remote_filesystems" ownerid="OL07-00-021021" disa="366" severity="medium"> -+ <VMSinfo VKey="221744" SVKey="221744r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="mount_option_dev_shm_nosuid" ownerid="OL07-00-021024" disa="1764" severity="low"> -+ <VMSinfo VKey="221747" SVKey="221747r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must mount /dev/shm with secure options."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dir_perms_world_writable_system_owned_group" ownerid="OL07-00-021030" disa="366" severity="medium"> -+ <VMSinfo VKey="221748" SVKey="221748r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="dir_perms_world_writable_system_owned" ownerid="OL07-00-021031" disa="366" severity="medium"> -+ <VMSinfo VKey="228566" SVKey="228566r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all world-writable directories are owned by root, sys, bin, or an application user."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_umask_interactive_users" ownerid="OL07-00-021040" disa="366" severity="medium"> -+ <VMSinfo VKey="221749" SVKey="221749r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must set the umask value to 077 for all local interactive user accounts."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="rsyslog_cron_logging" ownerid="OL07-00-021100" disa="366" severity="medium"> -+ <VMSinfo VKey="221750" SVKey="221750r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must have cron logging implemented."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_owner_cron_allow" ownerid="OL07-00-021110" disa="366" severity="medium"> -+ <VMSinfo VKey="221751" SVKey="221751r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_groupowner_cron_allow" ownerid="OL07-00-021120" disa="366" severity="medium"> -+ <VMSinfo VKey="221752" SVKey="221752r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="service_kdump_disabled" ownerid="OL07-00-021300" disa="366" severity="medium"> -+ <VMSinfo VKey="221753" SVKey="221753r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must disable Kernel core dumps unless needed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="partition_for_home" ownerid="OL07-00-021310" disa="366" severity="low"> -+ <VMSinfo VKey="221754" SVKey="221754r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="partition_for_var" ownerid="OL07-00-021320" disa="366" severity="low"> -+ <VMSinfo VKey="221755" SVKey="221755r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a separate file system for /var."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="partition_for_var_log_audit" ownerid="OL07-00-021330" disa="1849" severity="low"> -+ <VMSinfo VKey="221756" SVKey="221756r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a separate file system for the system audit data path large enough to hold at least one week of audit data."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="partition_for_tmp" ownerid="OL07-00-021340" disa="366" severity="low"> -+ <VMSinfo VKey="221757" SVKey="221757r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a separate file system for /tmp (or equivalent)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="grub2_enable_fips_mode" ownerid="OL07-00-021350" disa="2476" severity="high"> -+ <VMSinfo VKey="221758" SVKey="221758r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="aide_verify_acls" ownerid="OL07-00-021600" disa="366" severity="low"> -+ <VMSinfo VKey="221759" SVKey="221759r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="aide_verify_ext_attributes" ownerid="OL07-00-021610" disa="366" severity="low"> -+ <VMSinfo VKey="221760" SVKey="221760r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="aide_use_fips_hashes" ownerid="OL07-00-021620" disa="366" severity="medium"> -+ <VMSinfo VKey="221761" SVKey="221761r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="grub2_no_removeable_media" ownerid="OL07-00-021700" disa="1813" severity="medium"> -+ <VMSinfo VKey="221762" SVKey="221762r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not allow removable media to be used as the boot loader unless approved."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="package_telnet-server_removed" ownerid="OL07-00-021710" disa="381" severity="high"> -+ <VMSinfo VKey="221763" SVKey="221763r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have the telnet-server package installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="service_auditd_enabled" ownerid="OL07-00-030000" disa="1814" severity="medium"> -+ <VMSinfo VKey="221764" SVKey="221764r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_system_shutdown" ownerid="OL07-00-030010" disa="139" severity="medium"> -+ <VMSinfo VKey="221765" SVKey="221765r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must shut down upon audit processing failure, unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit processing failure."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_name_format" ownerid="OL07-00-030201" disa="1851" severity="medium"> -+ <VMSinfo VKey="221767" SVKey="221767r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured to off-load audit logs onto a different system or storage media from the system being audited."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_name_format" ownerid="OL07-00-030210" disa="1851" severity="medium"> -+ <VMSinfo VKey="221768" SVKey="221768r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must take appropriate action when the remote logging buffer is full."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_name_format" ownerid="OL07-00-030211" disa="1851" severity="medium"> -+ <VMSinfo VKey="221769" SVKey="221769r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must label all off-loaded audit logs before sending them to the central log server."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_audispd_configure_remote_server" ownerid="OL07-00-030300" disa="1851" severity="medium"> -+ <VMSinfo VKey="221770" SVKey="221770r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must off-load audit records onto a different system or media from the system being audited."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_audispd_encrypt_sent_records" ownerid="OL07-00-030310" disa="1851" severity="medium"> -+ <VMSinfo VKey="221771" SVKey="221771r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_audispd_disk_full_action" ownerid="OL07-00-030320" disa="1851" severity="medium"> -+ <VMSinfo VKey="221772" SVKey="221772r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_audispd_network_failure_action" ownerid="OL07-00-030321" disa="1851" severity="medium"> -+ <VMSinfo VKey="221773" SVKey="221773r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_data_retention_space_left" ownerid="OL07-00-030330" disa="1855" severity="medium"> -+ <VMSinfo VKey="221774" SVKey="221774r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must initiate an action to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_data_retention_space_left_action" ownerid="OL07-00-030340" disa="1855" severity="medium"> -+ <VMSinfo VKey="221775" SVKey="221775r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="auditd_data_retention_action_mail_acct" ownerid="OL07-00-030350" disa="1855" severity="medium"> -+ <VMSinfo VKey="221776" SVKey="221776r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands" ownerid="OL07-00-030360" disa="2234" severity="medium"> -+ <VMSinfo VKey="221777" SVKey="221777r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all executions of privileged functions."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_chown" ownerid="OL07-00-030370" disa="172" severity="medium"> -+ <VMSinfo VKey="221778" SVKey="221778r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the chown syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_fchown" ownerid="OL07-00-030380" disa="172" severity="medium"> -+ <VMSinfo VKey="221779" SVKey="221779r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the fchown syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_lchown" ownerid="OL07-00-030390" disa="172" severity="medium"> -+ <VMSinfo VKey="221780" SVKey="221780r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the lchown syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_fchownat" ownerid="OL07-00-030400" disa="172" severity="medium"> -+ <VMSinfo VKey="221781" SVKey="221781r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the fchownat syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_chmod" ownerid="OL07-00-030410" disa="172" severity="medium"> -+ <VMSinfo VKey="221782" SVKey="221782r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the chmod syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_fchmod" ownerid="OL07-00-030420" disa="172" severity="medium"> -+ <VMSinfo VKey="221783" SVKey="221783r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the fchmod syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_fchmodat" ownerid="OL07-00-030430" disa="172" severity="medium"> -+ <VMSinfo VKey="221784" SVKey="221784r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the fchmodat syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_setxattr" ownerid="OL07-00-030440" disa="172" severity="medium"> -+ <VMSinfo VKey="221785" SVKey="221785r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the setxattr syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_fsetxattr" ownerid="OL07-00-030450" disa="172" severity="medium"> -+ <VMSinfo VKey="221786" SVKey="221786r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the fsetxattr syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_lsetxattr" ownerid="OL07-00-030460" disa="172" severity="medium"> -+ <VMSinfo VKey="221787" SVKey="221787r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the lsetxattr syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_removexattr" ownerid="OL07-00-030470" disa="172" severity="medium"> -+ <VMSinfo VKey="221788" SVKey="221788r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the removexattr syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_fremovexattr" ownerid="OL07-00-030480" disa="172" severity="medium"> -+ <VMSinfo VKey="221789" SVKey="221789r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the fremovexattr syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_dac_modification_lremovexattr" ownerid="OL07-00-030490" disa="172" severity="medium"> -+ <VMSinfo VKey="221790" SVKey="221790r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the lremovexattr syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_modification_creat" ownerid="OL07-00-030500" disa="2884" severity="medium"> -+ <VMSinfo VKey="221791" SVKey="221791r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the creat syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_modification_open" ownerid="OL07-00-030510" disa="2884" severity="medium"> -+ <VMSinfo VKey="221792" SVKey="221792r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the open syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_modification_openat" ownerid="OL07-00-030520" disa="2884" severity="medium"> -+ <VMSinfo VKey="221793" SVKey="221793r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the openat syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_modification_open_by_handle_at" ownerid="OL07-00-030530" disa="2884" severity="medium"> -+ <VMSinfo VKey="221794" SVKey="221794r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the open_by_handle_at syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_modification_truncate" ownerid="OL07-00-030540" disa="2884" severity="medium"> -+ <VMSinfo VKey="221795" SVKey="221795r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the truncate syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_unsuccessful_file_modification_ftruncate" ownerid="OL07-00-030550" disa="2884" severity="medium"> -+ <VMSinfo VKey="221796" SVKey="221796r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the ftruncate syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_execution_semanage" ownerid="OL07-00-030560" disa="2884" severity="medium"> -+ <VMSinfo VKey="221797" SVKey="221797r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the semanage command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_execution_setsebool" ownerid="OL07-00-030570" disa="2884" severity="medium"> -+ <VMSinfo VKey="221798" SVKey="221798r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the setsebool command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_execution_chcon" ownerid="OL07-00-030580" disa="2884" severity="medium"> -+ <VMSinfo VKey="221799" SVKey="221799r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the chcon command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_execution_setfiles" ownerid="OL07-00-030590" disa="2884" severity="medium"> -+ <VMSinfo VKey="221800" SVKey="221800r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the setfiles command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_login_events_faillock" ownerid="OL07-00-030610" disa="2884" severity="medium"> -+ <VMSinfo VKey="221801" SVKey="221801r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must generate audit records for all unsuccessful account access events."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_login_events_lastlog" ownerid="OL07-00-030620" disa="2884" severity="medium"> -+ <VMSinfo VKey="221802" SVKey="221802r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must generate audit records for all successful account access events."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_passwd" ownerid="OL07-00-030630" disa="135" severity="medium"> -+ <VMSinfo VKey="221803" SVKey="221803r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the passwd command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_unix_chkpwd" ownerid="OL07-00-030640" disa="135" severity="medium"> -+ <VMSinfo VKey="221804" SVKey="221804r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the unix_chkpwd command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_gpasswd" ownerid="OL07-00-030650" disa="135" severity="medium"> -+ <VMSinfo VKey="221805" SVKey="221805r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the gpasswd command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_chage" ownerid="OL07-00-030660" disa="135" severity="medium"> -+ <VMSinfo VKey="221806" SVKey="221806r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the chage command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_userhelper" ownerid="OL07-00-030670" disa="135" severity="medium"> -+ <VMSinfo VKey="221807" SVKey="221807r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the userhelper command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_su" ownerid="OL07-00-030680" disa="130" severity="medium"> -+ <VMSinfo VKey="221808" SVKey="221808r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the su command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_sudo" ownerid="OL07-00-030690" disa="172" severity="medium"> -+ <VMSinfo VKey="221809" SVKey="221809r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the sudo command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_sysadmin_actions" ownerid="OL07-00-030700" disa="130" severity="medium"> -+ <VMSinfo VKey="221810" SVKey="221810r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_newgrp" ownerid="OL07-00-030710" disa="130" severity="medium"> -+ <VMSinfo VKey="221811" SVKey="221811r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the newgrp command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_chsh" ownerid="OL07-00-030720" disa="130" severity="medium"> -+ <VMSinfo VKey="221812" SVKey="221812r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the chsh command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_media_export" ownerid="OL07-00-030740" disa="2884" severity="medium"> -+ <VMSinfo VKey="221813" SVKey="221813r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the mount command and syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_umount" ownerid="OL07-00-030750" disa="135" severity="medium"> -+ <VMSinfo VKey="221814" SVKey="221814r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the umount command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_postdrop" ownerid="OL07-00-030760" disa="135" severity="medium"> -+ <VMSinfo VKey="221815" SVKey="221815r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the postdrop command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_postqueue" ownerid="OL07-00-030770" disa="135" severity="medium"> -+ <VMSinfo VKey="221816" SVKey="221816r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the postqueue command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_ssh_keysign" ownerid="OL07-00-030780" disa="135" severity="medium"> -+ <VMSinfo VKey="221817" SVKey="221817r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the ssh-keysign command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_crontab" ownerid="OL07-00-030800" disa="135" severity="medium"> -+ <VMSinfo VKey="221818" SVKey="221818r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the crontab command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_privileged_commands_pam_timestamp_check" ownerid="OL07-00-030810" disa="172" severity="medium"> -+ <VMSinfo VKey="221819" SVKey="221819r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the pam_timestamp_check command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_kernel_module_loading_delete" ownerid="OL07-00-030819" disa="172" severity="medium"> -+ <VMSinfo VKey="221820" SVKey="221820r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the create_module syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_kernel_module_loading_init" ownerid="OL07-00-030820" disa="172" severity="medium"> -+ <VMSinfo VKey="221821" SVKey="221821r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the init_module syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_kernel_module_loading_finit" ownerid="OL07-00-030821" disa="172" severity="medium"> -+ <VMSinfo VKey="221822" SVKey="221822r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the finit_module syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_kernel_module_loading_delete" ownerid="OL07-00-030830" disa="172" severity="medium"> -+ <VMSinfo VKey="221823" SVKey="221823r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the delete_module syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_kernel_module_loading_delete" ownerid="OL07-00-030840" disa="172" severity="medium"> -+ <VMSinfo VKey="221824" SVKey="221824r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the kmod command."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_usergroup_modification_passwd" ownerid="OL07-00-030870" disa="2130" severity="medium"> -+ <VMSinfo VKey="221825" SVKey="221825r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_usergroup_modification_group" ownerid="OL07-00-030871" disa="18" severity="medium"> -+ <VMSinfo VKey="221826" SVKey="221826r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_usergroup_modification_gshadow" ownerid="OL07-00-030872" disa="18" severity="medium"> -+ <VMSinfo VKey="221827" SVKey="221827r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_usergroup_modification_shadow" ownerid="OL07-00-030873" disa="18" severity="medium"> -+ <VMSinfo VKey="221828" SVKey="221828r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_usergroup_modification_opasswd" ownerid="OL07-00-030874" disa="18" severity="medium"> -+ <VMSinfo VKey="221829" SVKey="221829r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_file_deletion_events_rename" ownerid="OL07-00-030880" disa="2884" severity="medium"> -+ <VMSinfo VKey="221830" SVKey="221830r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the rename syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_file_deletion_events_renameat" ownerid="OL07-00-030890" disa="2884" severity="medium"> -+ <VMSinfo VKey="221831" SVKey="221831r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the renameat syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_file_deletion_events_rmdir" ownerid="OL07-00-030900" disa="2884" severity="medium"> -+ <VMSinfo VKey="221832" SVKey="221832r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the rmdir syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_file_deletion_events_unlink" ownerid="OL07-00-030910" disa="2884" severity="medium"> -+ <VMSinfo VKey="221833" SVKey="221833r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the unlink syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="audit_rules_file_deletion_events_unlinkat" ownerid="OL07-00-030920" disa="2884" severity="medium"> -+ <VMSinfo VKey="221834" SVKey="221834r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must audit all uses of the unlinkat syscall."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="rsyslog_remote_loghost" ownerid="OL07-00-031000" disa="366" severity="medium"> -+ <VMSinfo VKey="221835" SVKey="221835r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must send rsyslog output to a log aggregation server."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="rsyslog_nolisten" ownerid="OL07-00-031010" disa="366" severity="medium"> -+ <VMSinfo VKey="221836" SVKey="221836r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="install_mcafee_antivirus" ownerid="OL07-00-032000" disa="366" severity="high"> -+ <VMSinfo VKey="221837" SVKey="221837r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a virus scan program."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_max_concurrent_login_sessions" ownerid="OL07-00-040000" disa="54" severity="low"> -+ <VMSinfo VKey="221838" SVKey="221838r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="configure_firewalld_ports" ownerid="OL07-00-040100" disa="2314" severity="medium"> -+ <VMSinfo VKey="221839" SVKey="221839r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_use_approved_ciphers" ownerid="OL07-00-040110" disa="3123" severity="medium"> -+ <VMSinfo VKey="221840" SVKey="221840r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="accounts_tmout" ownerid="OL07-00-040160" disa="1133" severity="medium"> -+ <VMSinfo VKey="221841" SVKey="221841r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except to fulfill documented and validated mission requirements."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_enable_warning_banner" ownerid="OL07-00-040170" disa="48" severity="medium"> -+ <VMSinfo VKey="221842" SVKey="221842r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sssd_ldap_start_tls" ownerid="OL07-00-040180" disa="1453" severity="medium"> -+ <VMSinfo VKey="221843" SVKey="221843r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sssd_ldap_configure_tls_reqcert" ownerid="OL07-00-040190" disa="1453" severity="medium"> -+ <VMSinfo VKey="221844" SVKey="221844r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sssd_ldap_configure_tls_ca" ownerid="OL07-00-040200" disa="1453" severity="medium"> -+ <VMSinfo VKey="221845" SVKey="221845r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_kernel_randomize_va_space" ownerid="OL07-00-040201" disa="2824" severity="medium"> -+ <VMSinfo VKey="221846" SVKey="221846r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must implement virtual address space randomization."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="package_openssh-server_installed" ownerid="OL07-00-040300" disa="2422" severity="medium"> -+ <VMSinfo VKey="221847" SVKey="221847r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all networked systems have SSH installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="service_sshd_enabled" ownerid="OL07-00-040310" disa="2418" severity="medium"> -+ <VMSinfo VKey="221848" SVKey="221848r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_set_idle_timeout" ownerid="OL07-00-040320" disa="1133" severity="medium"> -+ <VMSinfo VKey="221849" SVKey="221849r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission requirements."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_rhosts_rsa" ownerid="OL07-00-040330" disa="366" severity="medium"> -+ <VMSinfo VKey="221850" SVKey="221850r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_set_keepalive" ownerid="OL07-00-040340" disa="1133" severity="medium"> -+ <VMSinfo VKey="221851" SVKey="221851r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_rhosts" ownerid="OL07-00-040350" disa="366" severity="medium"> -+ <VMSinfo VKey="221852" SVKey="221852r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_print_last_log" ownerid="OL07-00-040360" disa="366" severity="medium"> -+ <VMSinfo VKey="221853" SVKey="221853r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must display the date and time of the last successful account logon upon an SSH logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_root_login" ownerid="OL07-00-040370" disa="366" severity="medium"> -+ <VMSinfo VKey="221854" SVKey="221854r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not permit direct logons to the root account using remote access via SSH."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_user_known_hosts" ownerid="OL07-00-040380" disa="366" severity="medium"> -+ <VMSinfo VKey="221855" SVKey="221855r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_allow_only_protocol2" ownerid="OL07-00-040390" disa="197" severity="high"> -+ <VMSinfo VKey="221856" SVKey="221856r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_use_approved_macs" ownerid="OL07-00-040400" disa="1453" severity="medium"> -+ <VMSinfo VKey="221857" SVKey="221857r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_permissions_sshd_pub_key" ownerid="OL07-00-040410" disa="366" severity="medium"> -+ <VMSinfo VKey="221858" SVKey="221858r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_permissions_sshd_private_key" ownerid="OL07-00-040420" disa="366" severity="medium"> -+ <VMSinfo VKey="221859" SVKey="221859r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_gssapi_auth" ownerid="OL07-00-040430" disa="1813" severity="medium"> -+ <VMSinfo VKey="221860" SVKey="221860r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_kerb_auth" ownerid="OL07-00-040440" disa="1813" severity="medium"> -+ <VMSinfo VKey="221861" SVKey="221861r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_enable_strictmodes" ownerid="OL07-00-040450" disa="366" severity="medium"> -+ <VMSinfo VKey="221862" SVKey="221862r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_use_priv_separation" ownerid="OL07-00-040460" disa="366" severity="medium"> -+ <VMSinfo VKey="221863" SVKey="221863r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon uses privilege separation."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_disable_compression" ownerid="OL07-00-040470" disa="366" severity="medium"> -+ <VMSinfo VKey="221864" SVKey="221864r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="XXXX" ownerid="OL07-00-040480" disa="2468" severity="medium"> -+ <VMSinfo VKey="221865" SVKey="221865r5059" VRelease="r505922"/> -+ <title text="The operating system must request and perform data origin authentication verification and data integrity verification on the name/address resolution responses the system receives from authoritative sources."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="chronyd_or_ntpd_set_maxpoll" ownerid="OL07-00-040500" disa="1891" severity="medium"> -+ <VMSinfo VKey="221866" SVKey="221866r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_tcp_invalid_ratelimit" ownerid="OL07-00-040510" disa="2385" severity="medium"> -+ <VMSinfo VKey="221867" SVKey="221867r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must protect against or limit the effects of Denial of Service (DoS) attacks by validating the operating system is implementing rate-limiting measures on impacted network interfaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="service_firewalld_enabled" ownerid="OL07-00-040520" disa="366" severity="medium"> -+ <VMSinfo VKey="221868" SVKey="221868r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must enable an application firewall, if available."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="display_login_attempts" ownerid="OL07-00-040530" disa="366" severity="low"> -+ <VMSinfo VKey="221869" SVKey="221869r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must display the date and time of the last successful account logon upon logon."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="no_user_host_based_files" ownerid="OL07-00-040540" disa="366" severity="high"> -+ <VMSinfo VKey="221870" SVKey="221870r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not contain .shosts files."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="no_host_based_files" ownerid="OL07-00-040550" disa="366" severity="high"> -+ <VMSinfo VKey="221871" SVKey="221871r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not contain shosts.equiv files."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="network_configure_name_resolution" ownerid="OL07-00-040600" disa="366" severity="low"> -+ <VMSinfo VKey="221872" SVKey="221872r5059" VRelease="r505922"/> -+ <title text="For Oracle Linux operating systems using DNS resolution, at least two name servers must be configured."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_all_accept_source_route" ownerid="OL07-00-040610" disa="366" severity="medium"> -+ <VMSinfo VKey="221873" SVKey="221873r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_all_rp_filter" ownerid="OL07-00-040611" disa="366" severity="medium"> -+ <VMSinfo VKey="221874" SVKey="221874r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_default_rp_filter" ownerid="OL07-00-040612" disa="366" severity="medium"> -+ <VMSinfo VKey="221875" SVKey="221875r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_default_accept_source_route" ownerid="OL07-00-040620" disa="366" severity="medium"> -+ <VMSinfo VKey="221876" SVKey="221876r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_icmp_echo_ignore_broadcasts" ownerid="OL07-00-040630" disa="366" severity="medium"> -+ <VMSinfo VKey="221877" SVKey="221877r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_default_accept_redirects" ownerid="OL07-00-040640" disa="366" severity="medium"> -+ <VMSinfo VKey="221878" SVKey="221878r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_all_accept_redirects" ownerid="OL07-00-040641" disa="366" severity="medium"> -+ <VMSinfo VKey="221879" SVKey="221879r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_default_send_redirects" ownerid="OL07-00-040650" disa="366" severity="medium"> -+ <VMSinfo VKey="221880" SVKey="221880r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_conf_all_send_redirects" ownerid="OL07-00-040660" disa="366" severity="medium"> -+ <VMSinfo VKey="221881" SVKey="221881r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="network_sniffer_disabled" ownerid="OL07-00-040670" disa="366" severity="medium"> -+ <VMSinfo VKey="221882" SVKey="221882r5059" VRelease="r505922"/> -+ <title text="Network interfaces configured on The Oracle Linux operating system must not be in promiscuous mode."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="postfix_prevent_unrestricted_relay" ownerid="OL07-00-040680" disa="366" severity="medium"> -+ <VMSinfo VKey="221883" SVKey="221883r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured to prevent unrestricted mail relaying."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="package_vsftpd_removed" ownerid="OL07-00-040690" disa="366" severity="high"> -+ <VMSinfo VKey="221884" SVKey="221884r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="package_tftp-server_removed" ownerid="OL07-00-040700" disa="366" severity="high"> -+ <VMSinfo VKey="221885" SVKey="221885r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sshd_enable_x11_forwarding" ownerid="OL07-00-040710" disa="366" severity="high"> -+ <VMSinfo VKey="221886" SVKey="221886r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that remote X connections for interactive users are encrypted."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="tftpd_uses_secure_mode" ownerid="OL07-00-040720" disa="366" severity="medium"> -+ <VMSinfo VKey="221887" SVKey="221887r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="package_xorg-x11-server-common_removed" ownerid="OL07-00-040730" disa="366" severity="medium"> -+ <VMSinfo VKey="221888" SVKey="221888r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have a graphical display manager installed unless approved."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv4_ip_forward" ownerid="OL07-00-040740" disa="366" severity="medium"> -+ <VMSinfo VKey="221889" SVKey="221889r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not be performing packet forwarding unless the system is a router."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="mount_option_krb_sec_remote_filesystems" ownerid="OL07-00-040750" disa="366" severity="medium"> -+ <VMSinfo VKey="221890" SVKey="221890r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="snmpd_not_default_password" ownerid="OL07-00-040800" disa="366" severity="high"> -+ <VMSinfo VKey="221891" SVKey="221891r5059" VRelease="r505922"/> -+ <title text="SNMP community strings on the Oracle Linux operating system must be changed from the default."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="set_firewalld_default_zone" ownerid="OL07-00-040810" disa="366" severity="medium"> -+ <VMSinfo VKey="221892" SVKey="221892r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system access control program must be configured to grant or deny system access to specific hosts and services."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="libreswan_approved_tunnels" ownerid="OL07-00-040820" disa="366" severity="medium"> -+ <VMSinfo VKey="221893" SVKey="221893r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not have unauthorized IP tunnels configured."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sysctl_net_ipv6_conf_all_accept_source_route" ownerid="OL07-00-040830" disa="366" severity="medium"> -+ <VMSinfo VKey="221894" SVKey="221894r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must not forward IPv6 source-routed packets."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="install_smartcard_packages" ownerid="OL07-00-041001" disa="1954" severity="medium"> -+ <VMSinfo VKey="221895" SVKey="221895r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must have the required packages for multifactor authentication installed."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="sssd_enable_pam_services" ownerid="OL07-00-041002" disa="1948" severity="medium"> -+ <VMSinfo VKey="221896" SVKey="221896r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM)."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="smartcard_configure_cert_checking" ownerid="OL07-00-041003" disa="1953" severity="medium"> -+ <VMSinfo VKey="221897" SVKey="221897r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must implement certificate status checking for PKI authentication."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="wireless_disable_interfaces" ownerid="OL07-00-041010" disa="2421" severity="medium"> -+ <VMSinfo VKey="221898" SVKey="221898r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must be configured so that all wireless network adapters are disabled."/> -+ </overlay> -+ <overlay owner="disastig" ruleid="file_permissions_var_log_audit" ownerid="OL07-00-910055" disa="164" severity="medium"> -+ <VMSinfo VKey="221899" SVKey="221899r5059" VRelease="r505922"/> -+ <title text="The Oracle Linux operating system must protect audit information from unauthorized read, modification, or deletion."/> -+ </overlay> -+</overlays> -diff --git a/shared/references/disa-stig-ol7-v1r1-xccdf-manual.xml b/shared/references/disa-stig-ol7-v1r1-xccdf-manual.xml -deleted file mode 100644 -index 48b9c6affb..0000000000 ---- a/shared/references/disa-stig-ol7-v1r1-xccdf-manual.xml -+++ /dev/null -@@ -1,4928 +0,0 @@ --<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dc="http://purl.org/dc/elements/1.1/" id="Oracle_Linux_7_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2020-02-04">accepted</status><title>Oracle Linux 7 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 1 Benchmark Date: 03 Feb 20201I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-OS-000256-GPOS-00097<GroupDescription></GroupDescription>OL07-00-010010The Oracle Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.<VulnDiscussion>Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default. -- --Satisfies: SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000278-GPOS-00108</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001493CCI-001494CCI-001495CCI-001496Run the following command to determine which package owns the file: -- --# rpm -qf <filename> -- --Reset the permissions of files within a package with the following command: -- --#rpm --setperms <packagename> -- --Reset the user and group ownership of files within a package with the following command: -- --#rpm --setugids <packagename>Verify the file permissions, ownership, and group membership of system files and commands match the vendor values. -- --Check the default file permissions, ownership, and group membership of system files and commands with the following command: -- --# for i in `rpm -Va | grep '^.M' | cut -d " " -f4,5`;do for j in `rpm -qf $i`;do rpm -ql $j --dump | cut -d " " -f1,5,6,7 | grep $i;done;done --/var/log/gdm 040755 root root --/etc/audisp/audisp-remote.conf 0100640 root root --/usr/bin/passwd 0104755 root root -- --For each file returned, verify the current permissions, ownership, and group membership: --# ls -la <filename> ---rw-------. 1 root root 133 Jan 11 13:25 /etc/audisp/audisp-remote.conf -- --If the file is more permissive than the default permissions, this is a finding. -- --If the file is not owned by the default owner and is not documented with the Information System Security Officer (ISSO), this is a finding. -- --If the file is not a member of the default group and is not documented with the ISSO, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-010020The Oracle Linux operating system must be configured so that the cryptographic hash of system files and commands matches vendor values.<VulnDiscussion>Without cryptographic integrity protections, system command and files can be altered by unauthorized users without detection. -- --Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Run the following command to determine which package owns the file: -- --# rpm -qf <filename> -- --The package can be reinstalled from a yum repository using the command: -- --# sudo yum reinstall <packagename> -- --Alternatively, the package can be reinstalled from trusted media using the command: -- --# sudo rpm -Uvh <packagename>Verify the cryptographic hash of system files and commands match the vendor values. -- --Check the cryptographic hash of system files and commands with the following command: -- --Note: System configuration files (indicated by a "c" in the second column) are expected to change over time. Unusual modifications should be investigated through the system audit log. -- --# rpm -Va | grep '^..5' -- --If there is any output from the command for system files, or binaries, this is a finding.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>OL07-00-010030The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.<VulnDiscussion>The display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. -- --System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. -- --The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: -- --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. -- --By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." -- --Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000048CCI-000050CCI-001384CCI-001385CCI-001386CCI-001387CCI-001388Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: -- --# touch /etc/dconf/db/local.d/01-banner-message -- --Add the following line to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": -- --[org/gnome/login-screen] --banner-message-enable=true -- --Update the system databases: -- --# dconf update -- --Users must log out, and then log in again before the system-wide settings take effect.Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Check to see if the operating system displays a banner at the logon screen with the following command: -- --# grep banner-message-enable /etc/dconf/db/local.d/* --banner-message-enable=true -- --If "banner-message-enable" is set to "false" or is missing, this is a finding.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>OL07-00-010040The Oracle Linux operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.<VulnDiscussion>Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. -- --System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. -- --The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: -- --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. -- --By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." -- --Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007, SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000048Configure the operating system to display the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the system. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Create a database to contain the system-wide graphical user logon settings (if it does not already exist) with the following command: -- --# touch /etc/dconf/db/local.d/01-banner-message -- --Add the following line to the [org/gnome/login-screen] section of the "/etc/dconf/db/local.d/01-banner-message": -- --[org/gnome/login-screen] -- --banner-message-enable=true -- --banner-message-text='You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.' -- --Note: The "\n" characters are for formatting only. They will not be displayed on the GUI. -- --Run the following command to update the database: --# dconf updateVerify the operating system displays the approved Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a graphical user logon. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Check that the operating system displays the exact approved Standard Mandatory DoD Notice and Consent Banner text with the command: -- --# grep banner-message-text /etc/dconf/db/local.d/* --banner-message-text= --'You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n-At any time, the USG may inspect and seize data stored on this IS.\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.' -- --Note: The "\n" characters are for formatting only. They will not be displayed on the GUI. -- --If the banner does not match the approved Standard Mandatory DoD Notice and Consent Banner, this is a finding.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>OL07-00-010050The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a command line user logon.<VulnDiscussion>Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. -- --System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. -- --The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: -- --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. -- --By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." -- --Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000048Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the command line by editing the "/etc/issue" file. -- --Replace the default text with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is: --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. -- --By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."Verify the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the operating system via a command line user logon. -- --Check to see if the operating system displays a banner at the command line logon screen with the following command: -- --# more /etc/issue -- --The command should return the following text: --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. -- --By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." -- --If the operating system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding. -- --If the text in the "/etc/issue" file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.SRG-OS-000028-GPOS-00009<GroupDescription></GroupDescription>OL07-00-010060The Oracle Linux operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.<VulnDiscussion>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. -- --The session lock is implemented at the point where session activity can be determined. -- --Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system. -- --Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000056CCI-000058Configure the operating system to enable a user's session lock until that user re-establishes access using established identification and authentication procedures. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following example: -- --# touch /etc/dconf/db/local.d/00-screensaver -- --Edit the "[org/gnome/desktop/screensaver]" section of the database file and add or update the following lines: -- --# Set this to true to lock the screen when the screensaver activates --lock-enabled=true -- --Update the system databases: -- --# dconf update -- --Users must log out and then log in again before the system-wide settings take effect.Verify the operating system enables a user's session lock until that user re-establishes access using established identification and authentication procedures. The screen program must be installed to lock sessions on the console. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Check to see if the screen lock is enabled with the following command: -- --# grep -i lock-enabled /etc/dconf/db/local.d/* --lock-enabled=true -- --If the "lock-enabled" setting is missing or is not set to "true", this is a finding.SRG-OS-000375-GPOS-00160<GroupDescription></GroupDescription>OL07-00-010061The Oracle Linux operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.<VulnDiscussion>To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system. -- --Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. -- --Satisfies: SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001948Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --Note: The example is using the local system database, so if the system is using another database in "/etc/dconf/profile/user", create the file under the appropriate subdirectory. -- --# touch /etc/dconf/db/local.d/00-defaults -- --Edit "[org/gnome/login-screen]" and add or update the following line: --enable-smartcard-authentication=true -- --Update the system databases: --# dconf updateVerify the operating system uniquely identifies and authenticates users using multifactor authentication via a graphical user logon. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Determine which profile the system database is using with the following command: -- --# grep system-db /etc/dconf/profile/user -- --system-db:local -- --Note: The example is using the database local for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than local is being used. -- --# grep enable-smartcard-authentication /etc/dconf/db/local.d/* -- --enable-smartcard-authentication=true -- --If "enable-smartcard-authentication" is set to "false" or the keyword is missing, this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010062The Oracle Linux operating system must prevent a user from overriding the screensaver lock-enabled setting for the graphical user interface.<VulnDiscussion>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. -- --The session lock is implemented at the point where session activity can be determined. -- --The ability to enable/disable a session lock is given to the user by default. Disabling the user’s ability to disengage the graphical user interface session lock ensures all sessions will lock after the specified period of time.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. -- --# touch /etc/dconf/db/local.d/locks/session -- --Add the setting to lock the screensaver lock-enabled setting: -- --/org/gnome/desktop/screensaver/lock-enabledVerify the operating system prevents a user from overriding the screensaver lock-enabled setting for the graphical user interface. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. -- --Determine which profile the system database is using with the following command: --# grep system-db /etc/dconf/profile/user -- --system-db:local -- --Check for the lock-enabled setting with the following command: -- --Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. -- --# grep -i lock-enabled /etc/dconf/db/local.d/locks/* -- --/org/gnome/desktop/screensaver/lock-enabled -- --If the command does not return a result, this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010070The Oracle Linux operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.<VulnDiscussion>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system, but does not log out because of the temporary nature of the absence. Rather than relying on the user to lock the operating system session manually prior to leaving the workstation, operating systems must be able to identify when a user's session has idled, and take action to initiate the session lock. -- --The session lock is implemented at the point where session activity can be determined and/or controlled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Configure the operating system to initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --# touch /etc/dconf/db/local.d/00-screensaver -- --Edit /etc/dconf/db/local.d/00-screensaver and add or update the following lines: -- --[org/gnome/desktop/session] --# Set the lock time out to 900 seconds before the session is considered idle --idle-delay=uint32 900 -- --You must include the "uint32" along with the integer key values as shown. -- --Update the system databases: -- --# dconf update -- --Users must log out and then log in again before the system-wide settings take effect.Verify the operating system initiates a screensaver after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Check to see if GNOME is configured to display a screensaver after a 15 minute delay with the following command: -- --# grep -i idle-delay /etc/dconf/db/local.d/* --idle-delay=uint32 900 -- --If the "idle-delay" setting is missing or is not set to "900" or less, this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010081The Oracle Linux operating system must prevent a user from overriding the screensaver lock-delay setting for the graphical user interface.<VulnDiscussion>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to lock the operating system session manually prior to leaving the workstation, operating systems must be able to identify when a user's session has idled, and take action to initiate the session lock. -- --The session lock is implemented at the point where session activity can be determined and/or controlled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. -- --# touch /etc/dconf/db/local.d/locks/session -- --Add the setting to lock the screensaver lock delay: -- --/org/gnome/desktop/screensaver/lock-delayVerify the operating system prevents a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. -- --Determine which profile the system database is using with the following command: --# grep system-db /etc/dconf/profile/user -- --system-db:local -- --Check for the lock delay setting with the following command: -- --Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. -- --# grep -i lock-delay /etc/dconf/db/local.d/locks/* -- --/org/gnome/desktop/screensaver/lock-delay -- --If the command does not return a result, this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010082The Oracle Linux operating system must prevent a user from overriding the session idle-delay setting for the graphical user interface.<VulnDiscussion>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to lock their operating system session manually prior to leaving the workstation, operating systems must be able to identify when a user's session has idled and take action to initiate the session lock. -- --The session lock is implemented at the point where session activity can be determined and/or controlled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Configure the operating system to prevent a user from overriding a session lock after a 15-minute period of inactivity for graphical user interfaces. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --Note: The example below is using the database "local" for the system, so if the system is using another database in /etc/dconf/profile/user, the file should be created under the appropriate subdirectory. -- --# touch /etc/dconf/db/local.d/locks/session -- --Add the setting to lock the session idle delay: -- --/org/gnome/desktop/session/idle-delayVerify the operating system prevents a user from overriding session idle delay after a 15-minute period of inactivity for graphical user interfaces. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. -- --Determine which profile the system database is using with the following command: --# grep system-db /etc/dconf/profile/user -- --system-db:local -- --Check for the session idle delay setting with the following command: -- --Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. -- --# grep -i idle-delay /etc/dconf/db/local.d/locks/* -- --/org/gnome/desktop/session/idle-delay -- --If the command does not return a result, this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010090The Oracle Linux operating system must have the screen package installed.<VulnDiscussion>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system, but does not log out because of the temporary nature of the absence. Rather than relying on the user to lock their operating system session manually prior to leaving the workstation, operating systems must be able to identify when a user's session has idled, and take action to initiate the session lock. -- --The screen and tmux packages allow for a session lock to be implemented and configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Install the screen package to allow the initiation of a session lock after a 15-minute period of inactivity. -- --Install the screen program (if it is not on the system) with the following command: -- --# yum install screen -- --OR -- --Install the tmux program (if it is not on the system) with the following command: -- --#yum install tmuxVerify the operating system has the screen package installed. -- --Check to see if the screen package is installed with the following command: -- --# yum list installed screen --screen-4.3.1-3-x86_64.rpm -- --If the screen package is not installed, check to see if the tmux package is installed with the following command: -- --#yum list installed tmux --tmux-1.8-4.el7.x86_64.rpm -- --If either the screen package or the tmux package is not installed, this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010100The Oracle Linux operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.<VulnDiscussion>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system, but does not log out because of the temporary nature of the absence. Rather than relying on the user to lock their operating system session manually prior to leaving the workstation, operating systems must be able to identify when a user's session has idled and take action to initiate the session lock. -- --The session lock is implemented at the point where session activity can be determined and/or controlled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Configure the operating system to initiate a session lock after a 15-minute period of inactivity for graphical user interfaces. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --# touch /etc/dconf/db/local.d/00-screensaver -- --Add the setting to enable screensaver locking after 15 minutes of inactivity: -- --[org/gnome/desktop/screensaver] -- --idle-activation-enabled=true -- --Update the system databases: -- --# dconf update -- --Users must log out and then log in again before the system-wide settings take effect.Verify the operating system initiates a session lock after a 15-minute period of inactivity for graphical user interfaces. The screen program must be installed to lock sessions on the console. -- --If it is installed, GNOME must be configured to enforce a session lock after a 15-minute delay. Check for the session lock settings with the following commands: -- --# grep -i idle-activation-enabled /etc/dconf/db/local.d/* -- --idle-activation-enabled=true -- --If "idle-activation-enabled" is not set to "true", this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010101The Oracle Linux operating system must prevent a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface.<VulnDiscussion>A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. -- --The session lock is implemented at the point where session activity can be determined. -- --The ability to enable/disable a session lock is given to the user by default. Disabling the user's ability to disengage the graphical user interface session lock provides the assurance that all sessions will lock after the specified period of time.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Configure the operating system to prevent a user from overriding a screensaver lock after a 15-minute period of inactivity for graphical user interfaces. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --Note: The example below is using the database "local" for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. -- --# touch /etc/dconf/db/local.d/locks/session -- --Add the setting to lock the screensaver idle-activation-enabled setting: -- --/org/gnome/desktop/screensaver/idle-activation-enabledVerify the operating system prevents a user from overriding the screensaver idle-activation-enabled setting for the graphical user interface. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. -- --Determine which profile the system database is using with the following command: --# grep system-db /etc/dconf/profile/user -- --system-db:local -- --Check for the idle-activation-enabled setting with the following command: -- --Note: The example below is using the database "local" for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than "local" is being used. -- --# grep -i idle-activation-enabled /etc/dconf/db/local.d/locks/* -- --/org/gnome/desktop/screensaver/idle-activation-enabled -- --If the command does not return a result, this is a finding.SRG-OS-000029-GPOS-00010<GroupDescription></GroupDescription>OL07-00-010110The Oracle Linux operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.<VulnDiscussion>A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to lock their operating system session manually prior to leaving the workstation, operating systems must be able to identify when a user's session has idled, and take action to initiate the session lock. -- --The session lock is implemented at the point where session activity can be determined and/or controlled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000057Configure the operating system to initiate a session lock for graphical user interfaces when a screensaver is activated. -- --Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: -- --# touch /etc/dconf/db/local.d/00-screensaver -- --Add the setting to enable session locking when a screensaver is activated: -- --[org/gnome/desktop/screensaver] --lock-delay=uint32 5 -- --The "uint32" must be included along with the integer key values as shown. -- --Update the system databases: -- --# dconf update -- --Users must log out and then log in again before the system-wide settings take effect.Verify the operating system initiates a session lock a for graphical user interfaces when the screensaver is activated. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. The screen program must be installed to lock sessions on the console. -- --If GNOME is installed, check to see a session lock occurs when the screensaver is activated with the following command: -- --# grep -i lock-delay /etc/dconf/db/local.d/* --lock-delay=uint32 5 -- --If the "lock-delay" setting is missing, or is not set to "5" or less, this is a finding.SRG-OS-000069-GPOS-00037<GroupDescription></GroupDescription>OL07-00-010118The Oracle Linux operating system must be configured so that /etc/pam.d/passwd implements /etc/pam.d/system-auth when changing passwords.<VulnDiscussion>Pluggable authentication modules (PAM) allow for a modular approach to integrating authentication methods. PAM operates in a top-down processing model and if the modules are not listed in the correct order, an important security function could be bypassed if stack entries are not centralized.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000192Configure PAM to utilize /etc/pam.d/system-auth when changing passwords. -- --Add the following line to "/etc/pam.d/passwd" (or modify the line to have the required value): -- --password substack system-authVerify that /etc/pam.d/passwd is configured to use /etc/pam.d/system-auth when changing passwords: -- --# cat /etc/pam.d/passwd | grep -i substack | grep -i system-auth --password substack system-auth -- --If no results are returned, the line is commented out, this is a finding.SRG-OS-000069-GPOS-00037<GroupDescription></GroupDescription>OL07-00-010119The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, pwquality must be used.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. "pwquality" enforces complex password construction configuration and has the ability to limit brute-force attacks on the system. -- --Satisfied: SRG-OS-000480-GPOS-00229, SRG-OS-000069-GPOS-00037</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000192Configure the operating system to use "pwquality" to enforce password complexity rules. -- --Add the following line to "/etc/pam.d/system-auth" (or modify the line to have the required value): -- --password required pam_pwquality.so retry=3 -- --Note: The value of "retry" should be between "1" and "3".Verify the operating system uses "pwquality" to enforce the password complexity rules. -- --Check for the use of "pwquality" with the following command: -- --# cat /etc/pam.d/system-auth | grep pam_pwquality -- --password required pam_pwquality.so retry=3 -- --If the command does not return an uncommented line containing the value "pam_pwquality.so", this is a finding. -- --If the value of "retry" is set to "0" or greater than "3", this is a finding.SRG-OS-000069-GPOS-00037<GroupDescription></GroupDescription>OL07-00-010120The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one upper-case character.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one of several factors that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000192Configure the operating system to enforce password complexity by requiring that at least one upper-case character be used by setting the "ucredit" option. -- --Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): -- --ucredit = -1Note: The value to require a number of upper-case characters to be set is expressed as a negative number in "/etc/security/pwquality.conf". -- --Check the value for "ucredit" in "/etc/security/pwquality.conf" with the following command: -- --# grep ucredit /etc/security/pwquality.conf --ucredit = -1 -- --If the value of "ucredit" is not set to a negative value, this is a finding.SRG-OS-000070-GPOS-00038<GroupDescription></GroupDescription>OL07-00-010130The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one lower-case character.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one of several factors that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000193Configure the system to require at least one lower-case character when creating or changing a password. -- --Add or modify the following line --in "/etc/security/pwquality.conf": -- --lcredit = -1Note: The value to require a number of lower-case characters to be set is expressed as a negative number in "/etc/security/pwquality.conf". -- --Check the value for "lcredit" in "/etc/security/pwquality.conf" with the following command: -- --# grep lcredit /etc/security/pwquality.conf --lcredit = -1 -- --If the value of "lcredit" is not set to a negative value, this is a finding.SRG-OS-000071-GPOS-00039<GroupDescription></GroupDescription>OL07-00-010140The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are assigned, the new password must contain at least one numeric character.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one of several factors that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that must be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000194Configure the operating system to enforce password complexity by requiring that at least one numeric character be used by setting the "dcredit" option. -- --Add the following line to /etc/security/pwquality.conf (or modify the line to have the required value): -- --dcredit = -1Note: The value to require a number of numeric characters to be set is expressed as a negative number in "/etc/security/pwquality.conf". -- --Check the value for "dcredit" in "/etc/security/pwquality.conf" with the following command: -- --# grep dcredit /etc/security/pwquality.conf --dcredit = -1 -- --If the value of "dcredit" is not set to a negative value, this is a finding.SRG-OS-000266-GPOS-00101<GroupDescription></GroupDescription>OL07-00-010150The Oracle Linux operating system must be configured so that when passwords are changed or new passwords are established, the new password must contain at least one special character.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001619Configure the operating system to enforce password complexity by requiring that at least one special character be used by setting the "ocredit" option. -- --Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): -- --ocredit = -1Verify the operating system enforces password complexity by requiring that at least one special character be used. -- --Note: The value to require a number of special characters to be set is expressed as a negative number in "/etc/security/pwquality.conf". -- --Check the value for "ocredit" in "/etc/security/pwquality.conf" with the following command: -- --# grep ocredit /etc/security/pwquality.conf --ocredit=-1 -- --If the value of "ocredit" is not set to a negative value, this is a finding.SRG-OS-000072-GPOS-00040<GroupDescription></GroupDescription>OL07-00-010160The Oracle Linux operating system must be configured so that when passwords are changed a minimum of eight of the total number of characters must be changed.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000195Configure the operating system to require the change of at least eight of the total number of characters when passwords are changed by setting the "difok" option. -- --Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): -- --difok = 8The "difok" option sets the number of characters in a password that must not be present in the old password. -- --Check for the value of the "difok" option in "/etc/security/pwquality.conf" with the following command: -- --# grep difok /etc/security/pwquality.conf --difok = 8 -- --If the value of "difok" is set to less than "8", this is a finding.SRG-OS-000072-GPOS-00040<GroupDescription></GroupDescription>OL07-00-010170The Oracle Linux operating system must be configured so that when passwords are changed a minimum of four character classes must be changed.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000195Configure the operating system to require the change of at least four character classes when passwords are changed by setting the "minclass" option. -- --Add the following line to "/etc/security/pwquality.conf conf" (or modify the line to have the required value): -- --minclass = 4The "minclass" option sets the minimum number of required classes of characters for the new password (digits, uppercase, lower-case, others). -- --Check for the value of the "minclass" option in "/etc/security/pwquality.conf" with the following command: -- --# grep minclass /etc/security/pwquality.conf --minclass = 4 -- --If the value of "minclass" is set to less than "4", this is a finding.SRG-OS-000072-GPOS-00040<GroupDescription></GroupDescription>OL07-00-010180The Oracle Linux operating system must be configured so that when passwords are changed the number of repeating consecutive characters must not be more than three characters.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one of several factors that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000195Configure the operating system to require the change of the number of repeating consecutive characters when passwords are changed by setting the "maxrepeat" option. -- --Add the following line to "/etc/security/pwquality.conf conf" (or modify the line to have the required value): -- --maxrepeat = 3The "maxrepeat" option sets the maximum number of allowed same consecutive characters in a new password. -- --Check for the value of the "maxrepeat" option in "/etc/security/pwquality.conf" with the following command: -- --# grep maxrepeat /etc/security/pwquality.conf --maxrepeat = 3 -- --If the value of "maxrepeat" is set to more than "3", this is a finding.SRG-OS-000072-GPOS-00040<GroupDescription></GroupDescription>OL07-00-010190The Oracle Linux operating system must be configured so that when passwords are changed the number of repeating characters of the same character class must not be more than four characters.<VulnDiscussion>Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. -- --Password complexity is one of several factors that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000195Configure the operating system to require the change of the number of repeating characters of the same character class when passwords are changed by setting the "maxclassrepeat" option. -- --Add the following line to "/etc/security/pwquality.conf" conf (or modify the line to have the required value): -- --maxclassrepeat = 4The "maxclassrepeat" option sets the maximum number of allowed same consecutive characters in the same class in the new password. -- --Check for the value of the "maxclassrepeat" option in "/etc/security/pwquality.conf" with the following command: -- --# grep maxclassrepeat /etc/security/pwquality.conf --maxclassrepeat = 4 -- --If the value of "maxclassrepeat" is set to more than "4", this is a finding.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>OL07-00-010200The Oracle Linux operating system must be configured so that the PAM system service is configured to store only encrypted representations of passwords.<VulnDiscussion>Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000196Configure the operating system to store only SHA512 encrypted representations of passwords. -- --Add the following line in "/etc/pam.d/system-auth": --pam_unix.so sha512 shadow try_first_pass use_authtok -- --Add the following line in "/etc/pam.d/password-auth": --pam_unix.so sha512 shadow try_first_pass use_authtok -- --Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.Verify the PAM system service is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512. -- --Check that the system is configured to create SHA512 hashed passwords with the following command: -- --# grep password /etc/pam.d/system-auth /etc/pam.d/password-auth -- --Outcome should look like following: --/etc/pam.d/system-auth-ac:password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok --/etc/pam.d/password-auth:password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok -- --If the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" configuration files allow for password hashes other than SHA512 to be used, this is a finding.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>OL07-00-010210The Oracle Linux operating system must be configured to use the shadow file to store only encrypted representations of passwords.<VulnDiscussion>Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000196Configure the operating system to store only SHA512 encrypted representations of passwords. -- --Add or update the following line in "/etc/login.defs": -- --ENCRYPT_METHOD SHA512Verify the system's shadow file is configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is SHA512. -- --Check that the system is configured to create SHA512 hashed passwords with the following command: -- --# grep -i encrypt /etc/login.defs --ENCRYPT_METHOD SHA512 -- --If the "/etc/login.defs" configuration file does not exist or allows for password hashes other than SHA512 to be used, this is a finding.SRG-OS-000073-GPOS-00041<GroupDescription></GroupDescription>OL07-00-010220The Oracle Linux operating system must be configured so that user and group account administration utilities are configured to store only encrypted representations of passwords.<VulnDiscussion>Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. Passwords encrypted with a weak algorithm are no more protected than if they are kept in plain text.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000196Configure the operating system to store only SHA512 encrypted representations of passwords. -- --Add or update the following line in "/etc/libuser.conf" in the [defaults] section: -- --crypt_style = sha512Verify the user and group account administration utilities are configured to store only encrypted representations of passwords. The strength of encryption that must be used to hash passwords for all accounts is "SHA512". -- --Check that the system is configured to create "SHA512" hashed passwords with the following command: -- --# grep -i sha512 /etc/libuser.conf -- --crypt_style = sha512 -- --If the "crypt_style" variable is not set to "sha512", is not in the defaults section, is commented out, or does not exist, this is a finding.SRG-OS-000075-GPOS-00043<GroupDescription></GroupDescription>OL07-00-010230The Oracle Linux operating system must be configured so that passwords for new users are restricted to a 24 hours/1 day minimum lifetime.<VulnDiscussion>Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000198Configure the operating system to enforce 24 hours/1 day as the minimum password lifetime. -- --Add the following line in "/etc/login.defs" (or modify the line to have the required value): -- --PASS_MIN_DAYS 1Verify the operating system enforces 24 hours/1 day as the minimum password lifetime for new user accounts. -- --Check for the value of "PASS_MIN_DAYS" in "/etc/login.defs" with the following command: -- --# grep -i pass_min_days /etc/login.defs --PASS_MIN_DAYS 1 -- --If the "PASS_MIN_DAYS" parameter value is not "1" or greater, or is commented out, this is a finding.SRG-OS-000075-GPOS-00043<GroupDescription></GroupDescription>OL07-00-010240The Oracle Linux operating system must be configured so that passwords are restricted to a 24 hours/1 day minimum lifetime.<VulnDiscussion>Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000198Configure non-compliant accounts to enforce a 24 hours/1 day minimum password lifetime: -- --# chage -m 1 [user]Check whether the minimum time period between password changes for each user account is one day or greater. -- --# awk -F: '$4 < 1 {print $1 " " $4}' /etc/shadow -- --If any results are returned that are not associated with a system account, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>OL07-00-010250The Oracle Linux operating system must be configured so that passwords for new users are restricted to a 60-day maximum lifetime.<VulnDiscussion>Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000199Configure the operating system to enforce a 60-day maximum password lifetime restriction. -- --Add the following line in "/etc/login.defs" (or modify the line to have the required value): -- --PASS_MAX_DAYS 60If passwords are not being used for authentication, this is Not Applicable. -- --Verify the operating system enforces a 60-day maximum password lifetime restriction for new user accounts. -- --Check for the value of "PASS_MAX_DAYS" in "/etc/login.defs" with the following command: -- --# grep -i pass_max_days /etc/login.defs --PASS_MAX_DAYS 60 -- --If the "PASS_MAX_DAYS" parameter value is not 60 or less, or is commented out, this is a finding.SRG-OS-000076-GPOS-00044<GroupDescription></GroupDescription>OL07-00-010260The Oracle Linux operating system must be configured so that existing passwords are restricted to a 60-day maximum lifetime.<VulnDiscussion>Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000199Configure non-compliant accounts to enforce a 60-day maximum password lifetime restriction. -- --# chage -M 60 [user]Check whether the maximum time period for existing passwords is restricted to 60 days. -- --# awk -F: '$5 > 60 {print $1 " " $5}' /etc/shadow -- --If any results are returned that are not associated with a system account, this is a finding.SRG-OS-000077-GPOS-00045<GroupDescription></GroupDescription>OL07-00-010270The Oracle Linux operating system must be configured so that passwords are prohibited from reuse for a minimum of five generations.<VulnDiscussion>Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to reuse their password consecutively when that password has exceeded its defined lifetime, the end result is a password that is not changed per policy requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000200Configure the operating system to prohibit password reuse for a minimum of five generations. -- --Add the following line in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" (or modify the line to have the required value): -- --password requisite pam_pwhistory.so use_authtok remember=5 retry=3 -- --Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.Verify the operating system prohibits password reuse for a minimum of five generations. -- --Check for the value of the "remember" argument in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" with the following command: -- --# grep -i remember /etc/pam.d/system-auth /etc/pam.d/password-auth -- --password requisite pam_pwhistory.so use_authtok remember=5 retry=3 -- --If the line containing the "pam_pwhistory.so" line does not have the "remember" module argument set, is commented out, or the value of the "remember" module argument is set to less than "5", this is a finding.SRG-OS-000078-GPOS-00046<GroupDescription></GroupDescription>OL07-00-010280The Oracle Linux operating system must be configured so that passwords are a minimum of 15 characters in length.<VulnDiscussion>The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. -- --Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to increase exponentially the time and/or resources required to compromise the password.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000205Configure operating system to enforce a minimum 15-character password length. -- --Add the following line to "/etc/security/pwquality.conf" (or modify the line to have the required value): -- --minlen = 15Verify the operating system enforces a minimum 15-character password length. The "minlen" option sets the minimum number of characters in a new password. -- --Check for the value of the "minlen" option in "/etc/security/pwquality.conf" with the following command: -- --# grep minlen /etc/security/pwquality.conf --minlen = 15 -- --If the command does not return a "minlen" value of 15 or greater, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-010290The Oracle Linux operating system must not have accounts configured with blank or null passwords.<VulnDiscussion>If an account has an empty password, anyone could log on and run commands with the privileges of that account. Accounts with empty passwords should never be used in operational environments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366If an account is configured for password authentication but does not have an assigned password, it may be possible to log on to the account without authenticating. -- --Remove any instances of the "nullok" option in "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" to prevent logons with empty passwords. -- --Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.To verify that null passwords cannot be used, run the following command: -- --# grep nullok /etc/pam.d/system-auth /etc/pam.d/password-auth -- --If this produces any output, it may be possible to log on with accounts with empty passwords. -- --If null passwords can be used, this is a finding.SRG-OS-000106-GPOS-00053<GroupDescription></GroupDescription>OL07-00-010300The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password.<VulnDiscussion>Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000766To explicitly disallow remote logon from accounts with empty passwords, add or correct the following line in "/etc/ssh/sshd_config": -- --PermitEmptyPasswords no -- --The SSH service must be restarted for changes to take effect. Any accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords.To determine how the SSH daemon's "PermitEmptyPasswords" option is set, run the following command: -- --# grep -i PermitEmptyPasswords /etc/ssh/sshd_config --PermitEmptyPasswords no -- --If no line, a commented line, or a line indicating the value "no" is returned, the required value is set. -- --If the required value is not set, this is a finding.SRG-OS-000118-GPOS-00060<GroupDescription></GroupDescription>OL07-00-010310The Oracle Linux operating system must disable account identifiers (individuals, groups, roles, and devices) if the password expires.<VulnDiscussion>Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. -- --Operating systems need to track periods of inactivity and disable application identifiers after zero days of inactivity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000795Configure the operating system to disable account identifiers (individuals, groups, roles, and devices) after the password expires. -- --Add the following line to "/etc/default/useradd" (or modify the line to have the required value): -- --INACTIVE=0If passwords are not being used for authentication, this is Not Applicable. -- --Verify the operating system disables account identifiers (individuals, groups, roles, and devices) after the password expires with the following command: -- --# grep -i inactive /etc/default/useradd --INACTIVE=0 -- --If the value is not set to "0", is commented out, or is not defined, this is a finding.SRG-OS-000021-GPOS-00005<GroupDescription></GroupDescription>OL07-00-010320Accounts on the Oracle Linux operating system subjected to three unsuccessful logon attempts within 15 minutes must be locked for the maximum configurable period.<VulnDiscussion>By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as “brute-forcing”, is reduced. Limits are imposed by locking the account. -- --Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000044CCI-002238Configure the operating system to lock an account for the maximum period when three unsuccessful logon attempts in 15 minutes are made. -- --Modify the first three lines of the auth section and the first line of the account section of the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match the following lines: -- --auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --auth sufficient pam_unix.so try_first_pass --auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --account required pam_faillock.so -- --Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.Verify the operating system automatically locks an account for the maximum period for which the system can be configured. -- --Check that the system locks an account for the maximum period after three unsuccessful logon attempts within a period of 15 minutes, using the following command: -- --# grep pam_faillock.so /etc/pam.d/password-auth --auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --account required pam_faillock.so -- --If the "unlock_time" parameter is not set to "0", "never", or is set to a value less than "900" on both "auth" lines with the "pam_faillock.so" module, or is missing from these lines, this is a finding. -- --Note: The maximum configurable value for "unlock_time" is "604800". -- --If any line referencing the "pam_faillock.so" module is commented out, this is a finding. --# grep pam_faillock.so /etc/pam.d/system-auth --auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --account required pam_faillock.so -- --If the "unlock_time" parameter is not set to "0", "never", or is set to a value less than "900" on both "auth" lines with the "pam_faillock.so" module or is missing from these lines, this is a finding. --Note: The maximum configurable value for "unlock_time" is "604800". -- --If any line referencing the "pam_faillock.so" module is commented out, this is a finding.SRG-OS-000329-GPOS-00128<GroupDescription></GroupDescription>OL07-00-010330The Oracle Linux operating system must lock the associated account after three unsuccessful root logon attempts are made within a 15-minute period.<VulnDiscussion>By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. -- --Satisfies: SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002238Configure the operating system to lock automatically the root account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes are made. -- --Modify the first three lines of the auth section and the first line of the account section of the "/etc/pam.d/system-auth" and "/etc/pam.d/password-auth" files to match the following lines: -- --auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --auth sufficient pam_unix.so try_first_pass --auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --account required pam_faillock.so -- --Note: Manual changes to the listed files may be overwritten by the "authconfig" program. The "authconfig" program should not be used to update the configurations listed in this requirement.Verify the operating system automatically locks the root account until it is released by an administrator when three unsuccessful logon attempts in 15 minutes are made. -- --# grep pam_faillock.so /etc/pam.d/password-auth --auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --account required pam_faillock.so -- --If the "even_deny_root" setting is not defined on both lines with the "pam_faillock.so" module, is commented out, or is missing from a line, this is a finding. -- --# grep pam_faillock.so /etc/pam.d/system-auth --auth required pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --auth [default=die] pam_faillock.so authfail audit deny=3 even_deny_root fail_interval=900 unlock_time=900 --account required pam_faillock.so -- --If the "even_deny_root" setting is not defined on both lines with the "pam_faillock.so" module, is commented out, or is missing from a line, this is a finding.SRG-OS-000373-GPOS-00156<GroupDescription></GroupDescription>OL07-00-010340The Oracle Linux operating system must be configured so that users must provide a password for privilege escalation.<VulnDiscussion>Without reauthentication, users may access resources or perform tasks for which authorization has not been granted. -- --When operating systems provide the capability to escalate a functional capability, it is critical the user reauthenticate. -- --Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002038Configure the operating system to require users to supply a password for privilege escalation. -- --Check the configuration of the "/etc/sudoers" file with the following command: --# visudo -- --Remove any occurrences of "NOPASSWD" tags in the file. -- --Check the configuration of the /etc/sudoers.d/* files with the following command: --# grep -i nopasswd /etc/sudoers.d/* -- --Remove any occurrences of "NOPASSWD" tags in the file.If passwords are not being used for authentication, this is Not Applicable. -- --Verify the operating system requires users to supply a password for privilege escalation. -- --Check the configuration of the "/etc/sudoers" and "/etc/sudoers.d/*" files with the following command: -- --# grep -i nopasswd /etc/sudoers /etc/sudoers.d/* -- --If any uncommented line is found with a "NOPASSWD" tag, this is a finding.SRG-OS-000480-GPOS-00226<GroupDescription></GroupDescription>OL07-00-010430The Oracle Linux operating system must be configured so that the delay between logon prompts following a failed console logon attempt is at least four seconds.<VulnDiscussion>Configuring the operating system to implement organization-wide security implementation guides and security checklists verifies compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. -- --Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example, registry settings; account, file, and directory permission settings; and settings for functions, ports, protocols, services, and remote connections.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system to enforce a delay of at least four seconds between logon prompts following a failed console logon attempt. -- --Modify the "/etc/login.defs" file to set the "FAIL_DELAY" parameter to "4" or greater: -- --FAIL_DELAY 4Verify the operating system enforces a delay of at least four seconds between console logon prompts following a failed logon attempt. -- --Check the value of the "fail_delay" parameter in the "/etc/login.defs" file with the following command: -- --# grep -i fail_delay /etc/login.defs --FAIL_DELAY 4 -- --If the value of "FAIL_DELAY" is not set to "4" or greater, or the line is commented out, this is a finding.SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>OL07-00-010440The Oracle Linux operating system must not allow an unattended or automatic logon to the system via a graphical user interface.<VulnDiscussion>Failure to restrict system access to authenticated users negatively impacts operating system security.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system not to allow an unattended or automatic logon to the system via a graphical user interface. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Add or edit the line for the "AutomaticLoginEnable" parameter in the [daemon] section of the "/etc/gdm/custom.conf" file to "false": -- --[daemon] --AutomaticLoginEnable=falseVerify the operating system does not allow an unattended or automatic logon to the system via a graphical user interface. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Check for the value of the "AutomaticLoginEnable" in the "/etc/gdm/custom.conf" file with the following command: -- --# grep -i automaticloginenable /etc/gdm/custom.conf --AutomaticLoginEnable=false -- --If the value of "AutomaticLoginEnable" is not set to "false", this is a finding.SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>OL07-00-010450The Oracle Linux operating system must not allow an unrestricted logon to the system.<VulnDiscussion>Failure to restrict system access to authenticated users negatively impacts operating system security.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system not to allow an unrestricted account to log on to the system via a graphical user interface. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Add or edit the line for the "TimedLoginEnable" parameter in the [daemon] section of the "/etc/gdm/custom.conf" file to "false": -- --[daemon] --TimedLoginEnable=falseVerify the operating system does not allow an unrestricted logon to the system via a graphical user interface. -- --Note: If the system does not have GNOME installed, this requirement is Not Applicable. -- --Check for the value of the "TimedLoginEnable" parameter in "/etc/gdm/custom.conf" file with the following command: -- --# grep -i timedloginenable /etc/gdm/custom.conf --TimedLoginEnable=false -- --If the value of "TimedLoginEnable" is not set to "false", this is a finding.SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>OL07-00-010460The Oracle Linux operating system must not allow users to override SSH environment variables.<VulnDiscussion>Failure to restrict system access to authenticated users negatively impacts operating system security.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system not to allow users to override environment variables to the SSH daemon. -- --Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for "PermitUserEnvironment" keyword and set the value to "no": -- --PermitUserEnvironment no -- --The SSH service must be restarted for changes to take effect.Verify the operating system does not allow users to override environment variables to the SSH daemon. -- --Check for the value of the "PermitUserEnvironment" keyword with the following command: -- --# grep -i permituserenvironment /etc/ssh/sshd_config --PermitUserEnvironment no -- --If the "PermitUserEnvironment" keyword is not set to "no", is missing, or is commented out, this is a finding.SRG-OS-000480-GPOS-00229<GroupDescription></GroupDescription>OL07-00-010470The Oracle Linux operating system must not allow a non-certificate trusted host SSH logon to the system.<VulnDiscussion>Failure to restrict system access to authenticated users negatively impacts operating system security.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system not to allow a non-certificate trusted host SSH logon to the system. -- --Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for "HostbasedAuthentication" keyword and set the value to "no": -- --HostbasedAuthentication no -- --The SSH service must be restarted for changes to take effect.Verify the operating system does not allow a non-certificate trusted host SSH logon to the system. -- --Check for the value of the "HostbasedAuthentication" keyword with the following command: -- --# grep -i hostbasedauthentication /etc/ssh/sshd_config --HostbasedAuthentication no -- --If the "HostbasedAuthentication" keyword is not set to "no", is missing, or is commented out, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>OL07-00-010480Oracle Linux operating systems prior to version 7.2 with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.<VulnDiscussion>If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for Oracle Linux 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000213Configure the system to encrypt the boot password for root. -- --Generate an encrypted grub2 password for root with the following command: -- --Note: The hash generated is an example. -- --# grub2-mkpasswd-pbkdf2 -- --Enter Password: --Reenter Password: --PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45 -- --Edit "/etc/grub.d/40_custom" and add the following lines below the comments: -- --# vi /etc/grub.d/40_custom -- --set superusers="root" -- --password_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command} -- --Generate a new "grub.conf" file with the new password with the following commands: -- --# grub2-mkconfig --output=/tmp/grub2.cfg --# mv /tmp/grub2.cfg /boot/grub2/grub.cfgFor systems that use UEFI, this is Not Applicable. --For systems that are running Oracle Linux 7.2 or newer, this is Not Applicable. -- --Check to see if an encrypted root password is set. On systems that use a BIOS, use the following command: -- --# grep -i ^password_pbkdf2 /boot/grub2/grub.cfg -- --password_pbkdf2 [superusers-account] [password-hash] -- --If the root password entry does not begin with "password_pbkdf2", this is a finding. -- --If the "superusers-account" is not set to "root", this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>OL07-00-010481The Oracle Linux operating system must require authentication upon booting into single-user and maintenance modes.<VulnDiscussion>If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000213Configure the operating system to require authentication upon booting into single-user and maintenance modes. -- --Add or modify the "ExecStart" line in "/usr/lib/systemd/system/rescue.service" to include "/usr/sbin/sulogin": -- --ExecStart=-/bin/sh -c "/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default"Verify the operating system must require authentication upon booting into single-user and maintenance modes. -- --Check that the operating system requires authentication upon booting into single-user mode with the following command: -- --# grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin -- --ExecStart=-/bin/sh -c "/usr/sbin/sulogin; /usr/bin/systemctl --fail --no-block default" -- --If "ExecStart" does not have "/usr/sbin/sulogin" as an option, this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>OL07-00-010482Oracle Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes.<VulnDiscussion>If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for Oracle Linux 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000213Configure the system to encrypt the boot password for root. -- --Generate an encrypted grub2 password for root with the following command: -- --Note: The hash generated is an example. -- --# grub2-setpassword --Enter password: --Confirm password: -- --Edit the /boot/grub2/grub.cfg file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section: -- --set superusers="root" --export superusersFor systems that use BIOS, this is Not Applicable. -- --For systems that are running a version of Oracle Linux prior to 7.2, this is Not Applicable. -- --Check to see if an encrypted root password is set. On systems that use UEFI, use the following command: -- --# grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg --GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash] -- --If the root password does not begin with "grub.pbkdf2.sha512", this is a finding. -- --Verify that the "root" account is set as the "superusers": -- --# grep -iw "superusers" /boot/efi/EFI/redhat/grub.cfg --set superusers="root" --export superusers -- --If "superusers" is not set to "root" this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>OL07-00-010490Oracle Linux operating systems prior to version 7.2 using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.<VulnDiscussion>If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for Oracle Linux 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000213Configure the system to encrypt the boot password for root. -- --Generate an encrypted grub2 password for root with the following command: -- --Note: The hash generated is an example. -- --# grub2-mkpasswd-pbkdf2 -- --Enter Password: --Reenter Password: --PBKDF2 hash of your password is grub.pbkdf2.sha512.10000.F3A7CFAA5A51EED123BE8238C23B25B2A6909AFC9812F0D45 -- --Edit "/etc/grub.d/40_custom" and add the following lines below the comments: -- --# vi /etc/grub.d/40_custom -- --set superusers="root" -- --password_pbkdf2 root {hash from grub2-mkpasswd-pbkdf2 command} -- --Generate a new "grub.conf" file with the new password with the following commands: -- --# grub2-mkconfig --output=/tmp/grub2.cfg --# mv /tmp/grub2.cfg /boot/efi/EFI/redhat/grub.cfgFor systems that use BIOS, this is Not Applicable. --For systems that are running Oracle Linux 7.2 or newer, this is Not Applicable. -- --Check to see if an encrypted root password is set. On systems that use UEFI, use the following command: -- --# grep -i password /boot/efi/EFI/redhat/grub.cfg -- --password_pbkdf2 [superusers-account] [password-hash] -- --If the root password entry does not begin with "password_pbkdf2", this is a finding. -- --If the "superusers-account" is not set to "root", this is a finding.SRG-OS-000080-GPOS-00048<GroupDescription></GroupDescription>OL07-00-010491Oracle Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes.<VulnDiscussion>If the system does not require valid root authentication before it boots into single-user or maintenance mode, anyone who invokes single-user or maintenance mode is granted privileged access to all files on the system. GRUB 2 is the default boot loader for Oracle Linux 7 and is designed to require a password to boot into single-user mode or make modifications to the boot menu.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000213Configure the system to encrypt the boot password for root. -- --Generate an encrypted grub2 password for root with the following command: -- --Note: The hash generated is an example. -- --# grub2-setpassword --Enter password: --Confirm password: -- --Edit the /boot/efi/EFI/redhat/grub.cfg file and add or modify the following lines in the "### BEGIN /etc/grub.d/01_users ###" section: -- --set superusers="root" --export superusersFor systems that use BIOS, this is Not Applicable. -- --For systems that are running a version of RHEL prior to 7.2, this is Not Applicable. -- --Check to see if an encrypted root password is set. On systems that use UEFI, use the following command: -- --# grep -iw grub2_password /boot/efi/EFI/redhat/user.cfg --GRUB2_PASSWORD=grub.pbkdf2.sha512.[password_hash] -- --If the root password does not begin with "grub.pbkdf2.sha512", this is a finding. -- --Verify that the "root" account is set as the "superusers": -- --# grep -iw "superusers" /boot/efi/EFI/redhat/grub.cfg --set superusers="root" --export superusers -- --If "superusers" is not set to "root" this is a finding.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>OL07-00-010500The Oracle Linux operating system must uniquely identify and must authenticate organizational users (or processes acting on behalf of organizational users) using multifactor authentication.<VulnDiscussion>To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. -- --Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: -- --1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; -- --and -- --2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity. -- --Satisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000109-GPOS-00056, SRG-OS-000108-GPOS-00055, SRG-OS-000108-GPOS-00057, SRG-OS-000108-GPOS-00058</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000764CCI-000767CCI-000768CCI-000770Configure the operating system to require individuals to be authenticated with a multifactor authenticator. -- --Enable smartcard logons with the following commands: -- --# authconfig --enablesmartcard --smartcardaction=0 --update --# authconfig --enablerequiresmartcard -update -- --Modify the "/etc/pam_pkcs11/pkcs11_eventmgr.conf" file to uncomment the following line: -- --#/usr/X11R6/bin/xscreensaver-command -lock -- --Modify the "/etc/pam_pkcs11/pam_pkcs11.conf" file to use the cackey module if required.Verify the operating system requires multifactor authentication to uniquely identify organizational users using multifactor authentication. -- --Check to see if smartcard authentication is enforced on the system: -- --# authconfig --test | grep "pam_pkcs11 is enabled" -- --If no results are returned, this is a finding. -- --# authconfig --test | grep "smartcard removal action" -- --If "smartcard removal action" is blank, this is a finding. -- --# authconfig --test | grep "smartcard module" -- --If "smartcard module" is blank, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>OL07-00-020000The Oracle Linux operating system must not have the rsh-server package installed.<VulnDiscussion>It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked, and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. -- --Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -- --The rsh-server service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session and has very weak authentication. -- --If a privileged user were to log on using this service, the privileged user password could be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000381Configure the operating system to disable non-essential capabilities by removing the rsh-server package from the system with the following command: -- --# yum remove rsh-serverCheck to see if the rsh-server package is installed with the following command: -- --# yum list installed rsh-server -- --If the rsh-server package is installed, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>OL07-00-020010The Oracle Linux operating system must not have the ypserv package installed.<VulnDiscussion>Removing the "ypserv" package decreases the risk of the accidental (or intentional) activation of NIS or NIS+ services.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000381Configure the operating system to disable non-essential capabilities by removing the "ypserv" package from the system with the following command: -- --# yum remove ypservThe NIS service provides an unencrypted authentication service that does not provide for the confidentiality and integrity of user passwords or the remote session. -- --Check to see if the "ypserve" package is installed with the following command: -- --# yum list installed ypserv -- --If the "ypserv" package is installed, this is a finding.SRG-OS-000191-GPOS-00080<GroupDescription></GroupDescription>OL07-00-020019The Oracle Linux operating system must have a host-based intrusion detection tool installed.<VulnDiscussion>Adding host-based intrusion detection tools can provide the capability to take actions automatically in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools often include a reporting capability to provide network awareness of the system, which may not otherwise exist in an organization's systems management regime. -- --Satisfies: SRG-OS-000191-GPOS-00080, SRG-OS-000196</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001233Install and enable the latest McAfee HIPS package, available from USCYBERCOM. -- --Note: If the system does not support the McAfee HIPS package, install and enable a supported intrusion detection system application and document its use with the Authorizing Official.Consult with the SA or ISSO to determine if a host-based intrusion detection application is loaded on the system. Per OPORD 16-0080, the preferred intrusion detection system is McAfee HBSS available through the U.S. Cyber Command (USCYBERCOM). -- --If another host-based intrusion detection application is in use, such as SELinux, this must be documented and approved by the local Authorizing Official. -- --Procedure: --Examine the system to determine if the Host Intrusion Prevention System (HIPS) is installed: -- --# rpm -qa | grep MFEhiplsm -- --Verify the McAfee HIPS module is active on the system: -- --# ps -ef | grep -i "hipclient" -- --If the MFEhiplsm package is not installed, check for another intrusion detection system: -- --# find / -name <daemon name> -- --Where <daemon name> is the name of the primary application daemon to determine if the application is loaded on the system. -- --Determine if the application is active on the system: -- --# ps -ef | grep -i <daemon name> -- --If the MFEhiplsm package is not installed and an alternate host-based intrusion detection application has not been documented for use, this is a finding. -- --If no host-based intrusion detection system is installed and running on the system, this is a finding.SRG-OS-000324-GPOS-00125<GroupDescription></GroupDescription>OL07-00-020020The Oracle Linux operating system must prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.<VulnDiscussion>Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. -- --Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals who do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002235Configure the operating system to prevent non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. -- --Use the following command to map a new user to the "sysdam_u" role: -- --#semanage login -a -s sysadm_u <username> -- --Use the following command to map an existing user to the "sysdam_u" role: -- --#semanage login -m -s sysadm_u <username> -- --Use the following command to map a new user to the "staff_u" role: -- --#semanage login -a -s staff_u <username> -- --Use the following command to map an existing user to the "staff_u" role: -- --#semanage login -m -s staff_u <username> -- --Use the following command to map a new user to the "user_u" role: -- --# semanage login -a -s user_u <username> -- --Use the following command to map an existing user to the "user_u" role: -- --# semanage login -m -s user_u <username>If an HBSS or HIPS is active on the system, this is Not Applicable. -- --Verify the operating system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. -- --Get a list of authorized users (other than System Administrator and guest accounts) for the system. -- --Check the list against the system by using the following command: -- --# semanage login -l | more --Login Name SELinux User MLS/MCS Range Service --__default__ user_u s0-s0:c0.c1023 * --root unconfined_u s0-s0:c0.c1023 * --system_u system_u s0-s0:c0.c1023 * --joe staff_u s0-s0:c0.c1023 * -- --All administrators must be mapped to the "sysadm_u" or "staff_u" users role. -- --All authorized non-administrative users must be mapped to the "user_u" role. -- --If they are not mapped in this way, this is a finding.SRG-OS-000363-GPOS-00150<GroupDescription></GroupDescription>OL07-00-020030The Oracle Linux operating system must be configured so that a file integrity tool verifies the baseline operating system configuration at least weekly.<VulnDiscussion>Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. -- --Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item. -- --Satisfies: SRG-OS-000363-GPOS-00150 and SRG-OS-000446-GPOS-00200</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001744CCI-002699Configure the file integrity tool to run automatically on the system at least weekly. The following example output is generic. It will set cron to run AIDE daily, but other file integrity tools may be used: -- --# more /etc/cron.daily/aide --#!/bin/bash -- --/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.milVerify the operating system routinely checks the baseline configuration for unauthorized changes. -- --Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed at least once per week. -- --Check to see if AIDE is installed on the system with the following command: -- --# yum list installed aide -- --If AIDE is not installed, ask the SA how file integrity checks are performed on the system. -- --Check for the presence of a cron job running daily or weekly on the system that executes AIDE daily to scan for changes to the system baseline. The command used in the example will use a daily occurrence. -- --Check the cron directories for a script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command: -- --# ls -al /etc/cron.* | grep aide ---rwxr-xr-x 1 root root 29 Nov 22 2015 aide -- --# grep aide /etc/crontab /var/spool/cron/root --/etc/crontab: 30 04 * * * /root/aide --/var/spool/cron/root: 30 04 * * * /root/aide -- --If the file integrity application does not exist, or a script file controlling the execution of the file integrity application does not exist, this is a finding.SRG-OS-000363-GPOS-00150<GroupDescription></GroupDescription>OL07-00-020040The Oracle Linux operating system must be configured so that designated personnel are notified if baseline configurations are changed in an unauthorized manner.<VulnDiscussion>Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. -- --Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001744Configure the operating system to notify designated personnel if baseline configurations are changed in an unauthorized manner. The AIDE tool can be configured to email designated personnel with the use of the cron system. -- --The following example output is generic. It will set cron to run AIDE daily and to send email at the completion of the analysis. -- --# more /etc/cron.daily/aide -- --/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.milVerify the operating system notifies designated personnel if baseline configurations are changed in an unauthorized manner. -- --Note: A file integrity tool other than Advanced Intrusion Detection Environment (AIDE) may be used, but the tool must be executed and notify specified individuals via email or an alert. -- --Check to see if AIDE is installed on the system with the following command: -- --# yum list installed aide -- --If AIDE is not installed, ask the SA how file integrity checks are performed on the system. -- --Check for the presence of a cron job running routinely on the system that executes AIDE to scan for changes to the system baseline. The commands used in the example will use a daily occurrence. -- --Check the cron directories for a "crontab" script file controlling the execution of the file integrity application. For example, if AIDE is installed on the system, use the following command: -- --# ls -al /etc/cron.* | grep aide ---rwxr-xr-x 1 root root 32 Jul 1 2011 aide -- --# grep aide /etc/crontab /var/spool/cron/root --/etc/crontab: 30 04 * * * /root/aide --/var/spool/cron/root: 30 04 * * * /root/aide -- --AIDE does not have a configuration that will send a notification, so the cron job uses the mail application on the system to email the results of the file integrity run as in the following example: -- --# more /etc/cron.daily/aide --#!/bin/bash -- --/usr/sbin/aide --check | /bin/mail -s "$HOSTNAME - Daily aide integrity check run" root@sysname.mil -- --If the file integrity application does not notify designated personnel of changes, this is a finding.SRG-OS-000366-GPOS-00153<GroupDescription></GroupDescription>OL07-00-020050The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components from a repository without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.<VulnDiscussion>Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. -- --Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. -- --Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001749Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in the "/etc/yum.conf" file: -- --gpgcheck=1Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization. -- --Check that yum verifies the signature of packages from a repository prior to install with the following command: -- --# grep gpgcheck /etc/yum.conf --gpgcheck=1 -- --If "gpgcheck" is not set to "1", or if options are missing or commented out, ask the System Administrator how the certificates for patches and other operating system components are verified. -- --If there is no process to validate certificates that is approved by the organization, this is a finding.SRG-OS-000366-GPOS-00153<GroupDescription></GroupDescription>OL07-00-020060The Oracle Linux operating system must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization.<VulnDiscussion>Changes to any software components can have significant effects on the overall security of the operating system. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. -- --Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. -- --Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This verifies the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The operating system should not have to verify the software again. This requirement does not mandate DoD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001749Configure the operating system to verify the signature of local packages prior to install by setting the following option in the "/etc/yum.conf" file: -- --localpkg_gpgcheck=1Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components of local packages without verification that they have been digitally signed using a certificate that is recognized and approved by the organization. -- --Check that yum verifies the signature of local packages prior to install with the following command: -- --# grep localpkg_gpgcheck /etc/yum.conf --localpkg_gpgcheck=1 -- --If "localpkg_gpgcheck" is not set to "1", or if options are missing or commented out, ask the System Administrator how the signatures of local packages and other operating system components are verified. -- --If there is no process to validate the signatures of local packages that is approved by the organization, this is a finding.SRG-OS-000114-GPOS-00059<GroupDescription></GroupDescription>OL07-00-020100The Oracle Linux operating system must be configured to disable USB mass storage.<VulnDiscussion>USB mass storage permits easy introduction of unknown devices, thereby facilitating malicious activity. -- --Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000778Configure the operating system to disable the ability to use USB mass storage devices. -- --# vi /etc/modprobe.d/blacklist.conf -- --Add or update the line: -- --blacklist usb-storageIf there is an HBSS with a Device Control Module and a Data Loss Prevention mechanism, this requirement is not applicable. -- --Verify the operating system disables the ability to use USB mass storage devices. -- --Check to see if USB mass storage is disabled with the following command: -- --# grep usb-storage /etc/modprobe.d/blacklist.conf --blacklist usb-storage -- --If the command does not return any output or the output is not "blacklist usb-storage", and use of USB storage devices is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.SRG-OS-000378-GPOS-000163<GroupDescription></GroupDescription>OL07-00-020101The Oracle Linux operating system must be configured so that the Datagram Congestion Control Protocol (DCCP) kernel module is disabled unless required.<VulnDiscussion>Disabling DCCP protects the system against exploitation of any flaws in the protocol implementation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001958Configure the operating system to disable the ability to use the DCCP kernel module. -- --Create a file under "/etc/modprobe.d" with the following command: -- --# touch /etc/modprobe.d/dccp.conf -- --Add the following line to the created file: -- --install dccp /bin/true -- --Ensure that the DCCP module is blacklisted: -- --# vi /etc/modprobe.d/blacklist.conf -- --Add or update the line: -- --blacklist dccpVerify the operating system disables the ability to load the DCCP kernel module. -- --# grep -r dccp /etc/modprobe.d/* | grep -i "/bin/true" | grep -v "^#" -- --install dccp /bin/true -- --If the command does not return any output, or the line is commented out, and use of DCCP is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.SRG-OS-000114-GPOS-00059<GroupDescription></GroupDescription>OL07-00-020110The Oracle Linux operating system must disable the file system automounter unless required.<VulnDiscussion>Automatically mounting file systems permits easy introduction of unknown devices, thereby facilitating malicious activity. -- --Satisfies: SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000778Configure the operating system to disable the ability to automount devices. -- --Turn off the automount service with the following commands: -- --# systemctl stop autofs --# systemctl disable autofs -- --If "autofs" is required for Network File System (NFS), it must be documented with the ISSO.Verify the operating system disables the ability to automount devices. -- --Check to see if automounter service is active with the following command: -- --# systemctl status autofs --autofs.service - Automounts filesystems on demand --Loaded: loaded (/usr/lib/systemd/system/autofs.service; disabled) --Active: inactive (dead) -- --If the "autofs" status is set to "active" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.SRG-OS-000437-GPOS-00194<GroupDescription></GroupDescription>OL07-00-020200The Oracle Linux operating system must remove all software components after updated versions have been installed.<VulnDiscussion>Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002617Configure the operating system to remove all software components after updated versions have been installed. -- --Set the "clean_requirements_on_remove" option to "1" in the "/etc/yum.conf" file: -- --clean_requirements_on_remove=1Verify the operating system removes all software components after updated versions have been installed. -- --Check if yum is configured to remove unneeded packages with the following command: -- --# grep -i clean_requirements_on_remove /etc/yum.conf --clean_requirements_on_remove=1 -- --If "clean_requirements_on_remove" is not set to "1", "True", or "yes", or is not set in "/etc/yum.conf", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020230The Oracle Linux operating system must be configured so that the x86 Ctrl-Alt-Delete key sequence is disabled.<VulnDiscussion>A locally logged-on user, who presses Ctrl-Alt-Delete when at the console, can reboot the system. If accidentally pressed, as could happen in the case of a mixed OS environment, this can create the risk of short-term loss of availability of systems due to unintentional reboot. In the GNOME graphical environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is reduced because the user will be prompted before any action is taken.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the system to disable the Ctrl-Alt_Delete sequence for the command line with the following command: -- --# systemctl mask ctrl-alt-del.target -- --If GNOME is active on the system, create a database to contain the system-wide setting (if it does not already exist) with the following command: -- --# touch /etc/dconf/db/local.d/00-disable-CAD -- --Add the setting to disable the Ctrl-Alt_Delete sequence for GNOME: -- --[org/gnome/settings-daemon/plugins/media-keys] --logout=''Verify the operating system is not configured to reboot the system when Ctrl-Alt-Delete is pressed. -- --Check that the ctrl-alt-del.target is masked and not active with the following command: -- --# systemctl status ctrl-alt-del.target -- --ctrl-alt-del.target --Loaded: masked (/dev/null; bad) --Active: inactive (dead) -- --If the ctrl-alt-del.target is not masked, this is a finding. -- --If the ctrl-alt-del.target is active, this is a finding.SRG-OS-000480-GPOS-00228<GroupDescription></GroupDescription>OL07-00-020240The Oracle Linux operating system must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.<VulnDiscussion>Setting the most restrictive default permissions ensures that when new accounts are created, they do not have unnecessary access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system to define default permissions for all authenticated users in such a way that the user can only read and modify their own files. -- --Add or edit the line for the "UMASK" parameter in "/etc/login.defs" file to "077": -- --UMASK 077Verify the operating system defines default permissions for all authenticated users in such a way that the user can only read and modify their own files. -- --Check for the value of the "UMASK" parameter in "/etc/login.defs" file with the following command: -- --Note: If the value of the "UMASK" parameter is set to "000" in "/etc/login.defs" file, the Severity is raised to a CAT I. -- --# grep -i umask /etc/login.defs --UMASK 077 -- --If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing or is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020250The Oracle Linux operating system must be a vendor supported release.<VulnDiscussion>An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Upgrade to a supported version of the operating system.Verify the version of the operating system is vendor supported. -- --Check the version of the operating system with the following command: -- --# cat /etc/oracle-release -- --Oracle Linux Server release 7.6 -- --Current End of Premier Support for Oracle Linux 7 is Jul 2024 while Extended Support might consider extended term. -- --If the release is not supported by the vendor, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020260The Oracle Linux operating system security patches and updates must be installed and up to date.<VulnDiscussion>Timely patching is critical for maintaining the operational availability, confidentiality, and integrity of information technology (IT) systems. However, failure to keep operating system and application software patched is a common mistake made by IT professionals. New patches are released daily, and it is often difficult for even experienced System Administrators to keep abreast of all the new patches. When new weaknesses in an operating system exist, patches are usually made available by the vendor to resolve the problems. If the most recent security patches and updates are not installed, unauthorized users may take advantage of weaknesses in the unpatched software. The lack of prompt attention to patching could result in a system compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Install the operating system patches or updated packages available from Oracle within 30 days or sooner as local policy dictates.Verify the operating system security patches and updates are installed and up to date. Updates are required to be applied with a frequency determined by the site or Program Management Office (PMO). -- --Obtain the list of available package security updates from Oracle. The URL for updates is https://linux.oracle.com/errata/. It is important to note that updates provided by Oracle may not be present on the system if the underlying packages are not installed. -- --Check that the available package security updates have been installed on the system with the following command: -- --# yum history list | more --Loaded plugins: langpacks, product-id, subscription-manager --ID | Command line | Date and time | Action(s) | Altered --------------------------------------------------------------------------------- --70 | install aide | 2016-05-05 10:58 | Install | 1 --69 | update -y | 2016-05-04 14:34 | Update | 18 EE --68 | install vlc | 2016-04-21 17:12 | Install | 21 --67 | update -y | 2016-04-21 17:04 | Update | 7 EE --66 | update -y | 2016-04-15 16:47 | E, I, U | 84 EE -- --If package updates have not been performed on the system within the timeframe required by the site/program documentation, this is a finding. -- --Typical update frequency may be overridden by Information Assurance Vulnerability Alert (IAVA) notifications from CYBERCOM. -- --If the operating system is in non-compliance with the Information Assurance Vulnerability Management (IAVM) process, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020270The Oracle Linux operating system must not have unnecessary accounts.<VulnDiscussion>Accounts providing no operational purpose provide additional opportunities for system compromise. Unnecessary accounts include user accounts for individuals not requiring access to the system and application accounts for applications not installed on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the system so all accounts on the system are assigned to an active system, application, or user account. -- --Remove accounts that do not support approved system activities or that allow for a normal user to perform administrative-level actions. -- --Document all authorized accounts on the system.Verify all accounts on the system are assigned to an active system, application, or user account. -- --Obtain the list of authorized system accounts from the Information System Security Officer (ISSO). -- --Check the system accounts on the system with the following command: -- --# more /etc/passwd --root:x:0:0:root:/root:/bin/bash --bin:x:1:1:bin:/bin:/sbin/nologin --daemon:x:2:2:daemon:/sbin:/sbin/nologin --sync:x:5:0:sync:/sbin:/bin/sync --shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown --halt:x:7:0:halt:/sbin:/sbin/halt --games:x:12:100:games:/usr/games:/sbin/nologin --gopher:x:13:30:gopher:/var/gopher:/sbin/nologin -- --Accounts such as "games" and "gopher" are not authorized accounts as they do not support authorized system functions. -- --If the accounts on the system do not match the provided documentation, or accounts that do not support an authorized system function are present, this is a finding.SRG-OS-000104-GPOS-00051<GroupDescription></GroupDescription>OL07-00-020300The Oracle Linux operating system must be configured so that all Group Identifiers (GIDs) referenced in the /etc/passwd file are defined in the /etc/group file.<VulnDiscussion>If a user is assigned the GID of a group not existing on the system, and a group with the GID is subsequently created, the user may have unintended rights to any files associated with the group.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000764Configure the system to define all GIDs found in the "/etc/passwd" file by modifying the "/etc/group" file to add any non-existent group referenced in the "/etc/passwd" file, or change the GIDs referenced in the "/etc/passwd" file to a group that exists in "/etc/group".Verify all GIDs referenced in the "/etc/passwd" file are defined in the "/etc/group" file. -- --Check that all referenced GIDs exist with the following command: -- --# pwck -r -- --If GIDs referenced in then "/etc/passwd" file are returned as not defined in the "/etc/group" file, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020310The Oracle Linux operating system must be configured so that the root account must be the only account having unrestricted access to the system.<VulnDiscussion>If an account other than root also has a User Identifier (UID) of "0", it has root authority, giving that account unrestricted access to the entire operating system. Multiple accounts with a UID of "0" afford an opportunity for potential intruders to guess a password for a privileged account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the UID of any account on the system, other than root, that has a UID of "0". -- --If the account is associated with system commands or applications, the UID should be changed to one greater than "0" but less than "1000". Otherwise, assign a UID of greater than "1000" that has not already been assigned.Check the system for duplicate UID "0" assignments with the following command: -- --# awk -F: '$3 == 0 {print $1}' /etc/passwd -- --If any accounts other than root have a UID of "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020320The Oracle Linux operating system must be configured so that all files and directories have a valid owner.<VulnDiscussion>Unowned files and directories may be unintentionally inherited if a user is assigned the same User Identifier (UID) as the UID of the un-owned files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Either remove all files and directories from the system that do not have a valid user, or assign a valid user to all unowned files and directories on the system with the "chown" command: -- --# chown <user> <file>Verify all files and directories on the system have a valid owner. -- --Check the owner of all files and directories with the following command: -- --Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example. -- --# find / -fstype xfs -nouser -- --If any files on the system do not have an assigned owner, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020330The Oracle Linux operating system must be configured so that all files and directories have a valid group owner.<VulnDiscussion>Files without a valid group owner may be unintentionally inherited if a group is assigned the same Group Identifier (GID) as the GID of the files without a valid group owner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Either remove all files and directories from the system that do not have a valid group, or assign a valid group to all files and directories on the system with the "chgrp" command: -- --# chgrp <group> <file>Verify all files and directories on the system have a valid group. -- --Check the owner of all files and directories with the following command: -- --Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example. -- --# find / -fstype xfs -nogroup -- --If any files on the system do not have an assigned group, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020600The Oracle Linux operating system must be configured so that all local interactive users have a home directory assigned in the /etc/passwd file.<VulnDiscussion> If local interactive users are not assigned a valid home directory, there is no place for the storage and control of files they should own.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Assign home directories to all local interactive users that currently do not have a home directory assigned.Verify local interactive users on the system have a home directory assigned. -- --Check for missing local interactive user home directories with the following command: -- --# pwck -r --user 'lp': directory '/var/spool/lpd' does not exist --user 'news': directory '/var/spool/news' does not exist --user 'uucp': directory '/var/spool/uucp' does not exist --user 'smithj': directory '/home/smithj' does not exist -- --Ask the System Administrator (SA) if any users found without home directories are local interactive users. If the SA is unable to provide a response, check for users with a User Identifier (UID) of 1000 or greater with the following command: -- --# cut -d: -f 1,3 /etc/passwd | egrep ":[1-4][0-9]{2}$|:[0-9]{1,2}$" -- --If any interactive users do not have a home directory assigned, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020610The Oracle Linux operating system must be configured so that all local interactive user accounts, upon creation, are assigned a home directory.<VulnDiscussion>If local interactive users are not assigned a valid home directory, there is no place for the storage and control of owned files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system to assign home directories to all new local interactive users by setting the "CREATE_HOME" parameter in "/etc/login.defs" to "yes" as follows. -- --CREATE_HOME yesVerify all local interactive users on the system are assigned a home directory upon creation. -- --Check to see if the system is configured to create home directories for local interactive users with the following command: -- --# grep -i create_home /etc/login.defs --CREATE_HOME yes -- --If the value for "CREATE_HOME" parameter is not set to "yes", the line is missing, or the line is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020620The Oracle Linux operating system must be configured so that all local interactive user home directories are defined in the /etc/passwd file.<VulnDiscussion>If a local interactive user has a home directory defined that does not exist, the user may be given access to the / directory as the current working directory upon logon. This could create a denial of service because the user would not be able to access their logon configuration files, and it may give them visibility to system files they normally would not be able to access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Create home directories to all local interactive users that currently do not have a home directory assigned. Use the following commands to create the user home directory assigned in "/etc/ passwd": -- --Note: The example will be for the user smithj, who has a home directory of "/home/smithj", a UID of "smithj", and a Group Identifier (GID) of "users" assigned in "/etc/passwd". -- --# mkdir /home/smithj --# chown smithj /home/smithj --# chgrp users /home/smithj --# chmod 0750 /home/smithjVerify the assigned home directory of all local interactive users on the system exists. -- --Check the home directory assignment for all local interactive non-privileged users on the system with the following command: -- --# cut -d: -f 1,3,6 /etc/passwd | egrep ":[1-4][0-9]{3}" -- --smithj:1001:/home/smithj -- --Note: This may miss interactive users that have been assigned a privileged UID. Evidence of interactive use may be obtained from a number of log files containing system logon information. -- --Check that all referenced home directories exist with the following command: -- --# pwck -r --user 'smithj': directory '/home/smithj' does not exist -- --If any home directories referenced in "/etc/passwd" are returned as not defined, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020630The Oracle Linux operating system must be configured so that all local interactive user home directories have mode 0750 or less permissive.<VulnDiscussion>Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the mode of interactive user's home directories to "0750". To change the mode of a local interactive user's home directory, use the following command: -- --Note: The example will be for the user "smithj". -- --# chmod 0750 /home/smithjVerify the assigned home directory of all local interactive users has a mode of "0750" or less permissive. -- --Check the home directory assignment for all non-privileged users on the system with the following command: -- --Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. -- --# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6) ---rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj -- --If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less permissive, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020640The Oracle Linux operating system must be configured so that all local interactive user home directories are owned by their respective users.<VulnDiscussion>If a local interactive user does not own their home directory, unauthorized users could access or modify the user's files, and the users may not be able to access their own files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the owner of a local interactive user's home directories to that owner. To change the owner of a local interactive user's home directory, use the following command: -- --Note: The example will be for the user smithj, who has a home directory of "/home/smithj". -- --# chown smithj /home/smithjVerify the assigned home directory of all local interactive users on the system exists. -- --Check the home directory assignment for all local interactive users on the system with the following command: -- --# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6) -- ---rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj -- --If any home directories referenced in "/etc/passwd" are not owned by the interactive user, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020650The Oracle Linux operating system must be configured so that all local interactive user home directories are group-owned by the home directory owners primary group.<VulnDiscussion>If the Group Identifier (GID) of a local interactive user's home directory is not the same as the primary GID of the user, this would allow unauthorized access to the user's files, and users that share the same group may not be able to access files that they legitimately should.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the group owner of a local interactive user's home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command: -- --Note: The example will be for the user "smithj", who has a home directory of "/home/smithj", and has a primary group of users. -- --# chgrp users /home/smithjVerify the assigned home directory of all local interactive users is group-owned by that user's primary GID. -- --Check the home directory assignment for all local interactive users on the system with the following command: -- --# ls -ld $(egrep ':[0-9]{4}' /etc/passwd | cut -d: -f6) -- ---rwxr-x--- 1 smithj users 18 Mar 5 17:06 /home/smithj -- --Check the user's primary group with the following command: -- --# grep users /etc/group -- --users:x:250:smithj,jonesj,jacksons -- --If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020660The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories are owned by the owner of the home directory.<VulnDiscussion>If local interactive users do not own the files in their directories, unauthorized users may be able to access them. Additionally, if files are not owned by the user, this could be an indication of system compromise.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the owner of a local interactive user's files and directories to that owner. To change the owner of a local interactive user's files and directories, use the following command: -- --Note: The example will be for the user smithj, who has a home directory of "/home/smithj". -- --# chown smithj /home/smithj/<file or directory>Verify all files and directories in a local interactive user's home directory are owned by the user. -- --Check the owner of all files and directories in a local interactive user's home directory with the following command: -- --Note: The example will be for the user "smithj", who has a home directory of "/home/smithj". -- --# ls -lLR /home/smithj ---rw-r--r-- 1 smithj smithj 18 Mar 5 17:06 file1 ---rw-r--r-- 1 smithj smithj 193 Mar 5 17:06 file2 ---rw-r--r-- 1 smithj smithj 231 Mar 5 17:06 file3 -- --If any files are found with an owner different than the home directory user, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020670The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories are group-owned by a group of which the home directory owner is a member.<VulnDiscussion>If a local interactive user's files are group-owned by a group of which the user is not a member, unintended users may be able to access them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the group of a local interactive user's files and directories to a group that the interactive user is a member of. To change the group owner of a local interactive user's files and directories, use the following command: -- --Note: The example will be for the user smithj, who has a home directory of "/home/smithj" and is a member of the users group. -- --# chgrp users /home/smithj/<file>Verify all files and directories in a local interactive user home directory are group-owned by a group of which the user is a member. -- --Check the group owner of all files and directories in a local interactive user's home directory with the following command: -- --Note: The example will be for the user "smithj", who has a home directory of "/home/smithj". -- --# ls -lLR /<home directory>/<users home directory>/ ---rw-r--r-- 1 smithj smithj 18 Mar 5 17:06 file1 ---rw-r--r-- 1 smithj smithj 193 Mar 5 17:06 file2 ---rw-r--r-- 1 smithj sa 231 Mar 5 17:06 file3 -- --If any files are found with an owner different than the group home directory user, check to see if the user is a member of that group with the following command: -- --# grep smithj /etc/group --sa:x:100:juan,shelley,bob,smithj --smithj:x:521:smithj -- --If the user is not a member of a group that group-owns file(s) in a local interactive user's home directory, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020680The Oracle Linux operating system must be configured so that all files and directories contained in local interactive user home directories have a mode of 0750 or less permissive.<VulnDiscussion>If a local interactive user files have excessive permissions, unintended users may be able to access or modify them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the mode on files and directories in the local interactive user home directory with the following command: -- --Note: The example will be for the user smithj, who has a home directory of "/home/smithj" and is a member of the users group. -- --# chmod 0750 /home/smithj/<file>Verify all files and directories contained in a local interactive user home directory, excluding local initialization files, have a mode of "0750". -- --Check the mode of all non-initialization files in a local interactive user home directory with the following command: -- --Files that begin with a "." are excluded from this requirement. -- --Note: The example will be for the user "smithj", who has a home directory of "/home/smithj". -- --# ls -lLR /home/smithj ---rwxr-x--- 1 smithj smithj 18 Mar 5 17:06 file1 ---rwxr----- 1 smithj smithj 193 Mar 5 17:06 file2 ---rw-r-x--- 1 smithj smithj 231 Mar 5 17:06 file3 -- --If any files are found with a mode more permissive than "0750", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020690The Oracle Linux operating system must be configured so that all local initialization files for interactive users are owned by the home directory user or root.<VulnDiscussion>Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the owner of the local initialization files for interactive users to either the directory owner or root with the following command: -- --Note: The example will be for the smithj user, who has a home directory of "/home/smithj". -- --# chown smithj /home/smithj/.*Verify all local initialization files for interactive users are owned by the home directory user or root. -- --Check the owner on all local initialization files with the following command: -- --Note: The example will be for the "smithj" user, who has a home directory of "/home/smithj". -- --# ls -al /home/smithj/.* | more ---rwxr-xr-x 1 smithj users 896 Mar 10 2011 .bash_profile ---rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login ---rwxr-xr-x 1 smithj users 886 Jan 6 2007 .profile -- --If any file that sets a local interactive user's environment variables to override the system is not owned by the home directory owner or root, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020700The Oracle Linux operating system must be configured so that all local initialization files for local interactive users are be group-owned by the users primary group or root.<VulnDiscussion>Local initialization files for interactive users are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the group owner of a local interactive user's files to the group found in "/etc/passwd" for the user. To change the group owner of a local interactive user's home directory, use the following command: -- --Note: The example will be for the user smithj, who has a home directory of "/home/smithj", and has a primary group of users. -- --# chgrp users /home/smithj/<file>Verify the local initialization files of all local interactive users are group-owned by that user's primary Group Identifier (GID). -- --Check the home directory assignment for all non-privileged users on the system with the following command: -- --Note: The example will be for the smithj user, who has a home directory of "/home/smithj" and a primary group of "users". -- --# cut -d: -f 1,4,6 /etc/passwd | egrep ":[1-4][0-9]{3}" --smithj:1000:/home/smithj -- --# grep 1000 /etc/group --users:x:1000:smithj,jonesj,jacksons -- --Note: This may miss interactive users that have been assigned a privileged User Identifier (UID). Evidence of interactive use may be obtained from a number of log files containing system logon information. -- --Check the group owner of all local interactive user's initialization files with the following command: -- --# ls -al /home/smithj/.* ---rwxr-xr-x 1 smithj users 896 Mar 10 2011 .profile ---rwxr-xr-x 1 smithj users 497 Jan 6 2007 .login ---rwxr-xr-x 1 smithj users 886 Jan 6 2007 .something -- --If all local interactive user's initialization files are not group-owned by that user's primary GID, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020710The Oracle Linux operating system must be configured so that all local initialization files have mode 0740 or less permissive.<VulnDiscussion>Local initialization files are used to configure the user's shell environment upon logon. Malicious modification of these files could compromise accounts upon logon.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the mode of the local initialization files to "0740" with the following command: -- --Note: The example will be for the "smithj" user, who has a home directory of "/home/smithj". -- --# chmod 0740 /home/smithj/.<INIT_FILE>Verify that all local initialization files have a mode of "0740" or less permissive. -- --Check the mode on all local initialization files with the following command: -- --Note: The example will be for the "smithj" user, who has a home directory of "/home/smithj". -- --# ls -al /home/smithj/.* | more ---rwxr----- 1 smithj users 896 Mar 10 2011 .profile ---rwxr----- 1 smithj users 497 Jan 6 2007 .login ---rwxr----- 1 smithj users 886 Jan 6 2007 .something -- --If any local initialization files have a mode more permissive than "0740", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020720The Oracle Linux operating system must be configured so that all local interactive user initialization files executable search paths contain only paths that resolve to the users home directory.<VulnDiscussion>The executable search path (typically the PATH environment variable) contains a list of directories for the shell to search to find executables. If this path includes the current working directory (other than the user's home directory), executables in these directories may be executed instead of system commands. This variable is formatted as a colon-separated list of directories. If there is an empty entry, such as a leading or trailing colon or two consecutive colons, this is interpreted as the current working directory. If deviations from the default system search path for the local interactive user are required, they must be documented with the Information System Security Officer (ISSO).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Edit the local interactive user initialization files to change any PATH variable statements that reference directories other than their home directory. -- --If a local interactive user requires path variables to reference a directory owned by the application, it must be documented with the ISSO.Verify that all local interactive user initialization files' executable search path statements do not contain statements that will reference a working directory other than the users' home directory. -- --Check the executable search path statement for all local interactive user initialization files in the users' home directory with the following commands: -- --Note: The example will be for the smithj user, which has a home directory of "/home/smithj". -- --# grep -i path /home/smithj/.* --/home/smithj/.bash_profile:PATH=$PATH:$HOME/.local/bin:$HOME/bin --/home/smithj/.bash_profile:export PATH -- --If any local interactive user initialization files have executable search path statements that include directories outside of their home directory, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020730The Oracle Linux operating system must be configured so that local initialization files do not execute world-writable programs.<VulnDiscussion>If user start-up files execute world-writable programs, especially in unprotected directories, they could be maliciously modified to destroy user files or otherwise compromise the system at the user level. If the system is compromised at the user level, it is easier to elevate privileges to eventually compromise the system at the root and network level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the mode on files being executed by the local initialization files with the following command: -- --# chmod 0755 <file>Verify that local initialization files do not execute world-writable programs. -- --Check the system for world-writable files with the following command: -- --# find / -xdev -perm -002 -type f -exec ls -ld {} \; | more -- --For all files listed, check for their presence in the local initialization files with the following commands: -- --Note: The example will be for a system that is configured to create users' home directories in the "/home" directory. -- --# grep <file> /home/*/.* -- --If any local initialization files are found to reference world-writable files, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-020900The Oracle Linux operating system must be configured so that all system device files are correctly labeled to prevent unauthorized modification.<VulnDiscussion>If an unauthorized or modified device is allowed to exist on the system, there is the possibility the system may perform unintended or unauthorized operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Run the following command to determine which package owns the device file: -- --# rpm -qf <filename> -- --The package can be reinstalled from a yum repository using the command: -- --# sudo yum reinstall <packagename> -- --Alternatively, the package can be reinstalled from trusted media using the command: -- --# sudo rpm -Uvh <packagename>Verify that all system device files are correctly labeled to prevent unauthorized modification. -- --List all device files on the system that are incorrectly labeled with the following commands: -- --Note: Device files are normally found under "/dev", but applications may place device files in other directories and may necessitate a search of the entire system. -- --#find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n" -- --#find /dev -context *:unlabeled_t:* \( -type c -o -type b \) -printf "%p %Z\n" -- --Note: There are device files, such as "/dev/vmci", that are used when the operating system is a host virtual machine. They will not be owned by a user on the system and require the "device_t" label to operate. These device files are not a finding. -- --If there is output from either of these commands, other than already noted, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021000The Oracle Linux operating system must be configured so that file systems containing user home directories are mounted to prevent files with the setuid and setgid bit set from being executed.<VulnDiscussion>The "nosuid" mount option causes the system not to execute setuid and setgid files with owner privileges. This option must be used for mounting any file system not containing approved setuid and setguid files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the "/etc/fstab" to use the "nosuid" option on file systems that contain user home directories.Verify file systems that contain user home directories are mounted with the "nosuid" option. -- --Find the file system(s) that contain the user home directories with the following command: -- --Note: If a separate file system has not been created for the user home directories (user home directories are mounted under "/"), this is not a finding as the "nosuid" option cannot be used on the "/" system. -- --# cut -d: -f 1,3,6 /etc/passwd | egrep ":[1-4][0-9]{3}" --smithj:1001:/home/smithj --thomasr:1002:/home/thomasr -- --Check the file systems mounted at boot time with the following command: -- --# more /etc/fstab -- --UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /home ext4 rw,relatime,discard,data=ordered,nosuid 0 2 -- --If a file system found in "/etc/fstab" refers to the user home directory file system and it does not have the "nosuid" option set, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021010The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are used with removable media.<VulnDiscussion>The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the "/etc/fstab" to use the "nosuid" option on file systems that are associated with removable media.Verify file systems used for removable media are mounted with the "nosuid" option. -- --Check the file systems mounted at boot time with the following command: -- --# more /etc/fstab -- --UUID=2bc871e4-e2a3-4f29-9ece-3be60c835222 /mnt/usbflash vfat noauto,owner,ro,nosuid 0 0 -- --If a file system found in "/etc/fstab" refers to removable media and it does not have the "nosuid" option set, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021020The Oracle Linux operating system must prevent files with the setuid and setgid bit set from being executed on file systems that are being imported via Network File System (NFS).<VulnDiscussion>The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the "/etc/fstab" to use the "nosuid" option on file systems that are being imported via NFS.Verify file systems being NFS imported are configured with the "nosuid" option. -- --Find the file system(s) that contain the directories being exported with the following command: -- --# more /etc/fstab | grep nfs -- --UUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,nosuid 0 0 -- --If a file system found in "/etc/fstab" refers to NFS and it does not have the "nosuid" option set, this is a finding. -- --Verify the NFS is mounted with the "nosuid" option: -- --# mount | grep nfs | grep nosuid --If no results are returned, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021021The Oracle Linux operating system must prevent binary files from being executed on file systems that are being imported via Network File System (NFS).<VulnDiscussion>The "noexec" mount option causes the system not to execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the "/etc/fstab" to use the "noexec" option on file systems that are being imported via NFS.Verify file systems that are being NFS imported are configured with the "noexec" option. -- --Find the file system(s) that contain the directories being imported with the following command: -- --# more /etc/fstab | grep nfs -- --UUID=e06097bb-cfcd-437b-9e4d-a691f5662a7d /store nfs rw,noexec 0 0 -- --If a file system found in "/etc/fstab" refers to NFS and it does not have the "noexec" option set, and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding. -- --Verify the NFS is mounted with the "noexec"option: -- --# mount | grep nfs | grep noexec --If no results are returned and use of NFS imported binaries is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>OL07-00-021022The Oracle Linux operating system must mount /dev/shm with the nodev option.<VulnDiscussion>The "nodev" mount option causes the system to not interpret character or block special devices. Executing character or block special devices from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001764Configure the system so that /dev/shm is mounted with the "nodev" option.Verify that the "nodev" option is configured for /dev/shm: -- -- --# cat /etc/fstab | grep /dev/shm --tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0 -- --If any results are returned and the "nodev" option is not listed, this is a finding. -- --Verify "/dev/shm" is mounted with the "nodev" option: -- --# mount | grep "/dev/shm" | grep nodev -- --If no results are returned, this is a finding.SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>OL07-00-021023The Oracle Linux operating system must mount /dev/shm with the nosuid option.<VulnDiscussion>The "nosuid" mount option causes the system not to execute "setuid" and "setgid" files with owner privileges. This option must be used for mounting any file system not containing approved "setuid" and "setguid" files. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001764Configure the system so that /dev/shm is mounted with the "nosuid" option.Verify that the "nosuid" option is configured for /dev/shm: -- --# cat /etc/fstab | grep /dev/shm -- --tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0 -- --If any results are returned and the "nosuid" option is not listed, this is a finding. -- --Verify "/dev/shm" is mounted with the "nosuid" option: -- --# mount | grep "/dev/shm" | grep nosuid -- --If no results are returned, this is a finding.SRG-OS-000368-GPOS-00154<GroupDescription></GroupDescription>OL07-00-021024The Oracle Linux operating system must mount /dev/shm with the noexec option.<VulnDiscussion>The "noexec" mount option causes the system not to execute binary files. This option must be used for mounting any file system not containing approved binary files, as they may be incompatible. Executing files from untrusted file systems increases the opportunity for unprivileged users to attain unauthorized administrative access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001764Configure the system so that /dev/shm is mounted with the "noexec" option.Verify that the "noexec" option is configured for /dev/shm: -- --# cat /etc/fstab | grep /dev/shm -- --tmpfs /dev/shm tmpfs defaults,nodev,nosuid,noexec 0 0 -- --If any results are returned and the "noexec" option is not listed, this is a finding. -- --Verify "/dev/shm" is mounted with the "noexec" option: -- --# mount | grep "/dev/shm" | grep noexec -- --If no results are returned, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021030The Oracle Linux operating system must be configured so that all world-writable directories are group-owned by root, sys, bin, or an application group.<VulnDiscussion>If a world-writable directory has the sticky bit set and is not group-owned by a privileged Group Identifier (GID), unauthorized users may be able to modify files created by others. -- --The only authorized public directories are those temporary directories supplied with the system or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system and by users for temporary file storage, (e.g., /tmp), and for directories requiring global read/write access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Change the group of the world-writable directories to root with the following command: -- --# chgrp root <directory>Verify all world-writable directories are group-owned by root, sys, bin, or an application group. -- --Check the system for world-writable directories with the following command: -- --Note: The value after -fstype must be replaced with the filesystem type. XFS is used as an example. -- --# find / -xdev -perm -002 -type d -fstype xfs -exec ls -lLd {} \; --drwxrwxrwt 2 root root 40 Aug 26 13:07 /dev/mqueue --drwxrwxrwt 2 root root 220 Aug 26 13:23 /dev/shm --drwxrwxrwt 14 root root 4096 Aug 26 13:29 /tmp -- --If any world-writable directories are not owned by root, sys, bin, or an application group associated with the directory, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021040The Oracle Linux operating system must set the umask value to 077 for all local interactive user accounts.<VulnDiscussion>The umask controls the default access mode assigned to newly created files. A umask of 077 limits new files to mode 700 or less permissive. Although umask can be represented as a four-digit number, the first digit representing special access modes is typically ignored or required to be "0". This requirement applies to the globally configured system defaults and the local interactive user defaults for each account on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Remove the umask statement from all local interactive user's initialization files. -- --If the account is for an application, the requirement for a umask less restrictive than "077" can be documented with the Information System Security Officer, but the user agreement for access to the account must specify that the local interactive user must log on to their account first and then switch the user to the application account with the correct option to gain the account's environment variables.Verify that the default umask for all local interactive users is "077". -- --Identify the locations of all local interactive user home directories by looking at the "/etc/passwd" file. -- --Check all local interactive user initialization files for interactive users with the following command: -- --Note: The example is for a system that is configured to create users home directories in the "/home" directory. -- --# grep -i umask /home/*/.* -- --If any local interactive user initialization files are found to have a umask statement that has a value less restrictive than "077", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021100The Oracle Linux operating system must have cron logging implemented.<VulnDiscussion>Cron logging can be used to trace the successful or unsuccessful execution of cron jobs. It can also be used to spot intrusions into the use of the cron facility by unauthorized and malicious users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure "rsyslog" to log all cron messages by adding or updating the following line to "/etc/rsyslog.conf" or a configuration file in the /etc/rsyslog.d/ directory: -- --cron.* /var/log/cron.logVerify that "rsyslog" is configured to log cron events. -- --Check the configuration of "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files for the cron facility with the following command: -- --Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. -- --# grep cron /etc/rsyslog.conf /etc/rsyslog.d/*.conf --cron.* /var/log/cron.log -- --If the command does not return a response, check for cron logging all facilities by inspecting the "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files. -- --Look for the following entry: -- --*.* /var/log/messages -- --If "rsyslog" is not logging messages for the cron facility or all facilities, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021110The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is owned by root.<VulnDiscussion>If the owner of the "cron.allow" file is not set to root, the possibility exists for an unauthorized user to view or to edit sensitive information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the owner on the "/etc/cron.allow" file to root with the following command: -- --# chown root /etc/cron.allowVerify that the "cron.allow" file is owned by root. -- --Check the owner of the "cron.allow" file with the following command: -- --# ls -al /etc/cron.allow ---rw------- 1 root root 6 Mar 5 2011 /etc/cron.allow -- --If the "cron.allow" file exists and has an owner other than root, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021120The Oracle Linux operating system must be configured so that the cron.allow file, if it exists, is group-owned by root.<VulnDiscussion>If the group owner of the "cron.allow" file is not set to root, sensitive information could be viewed or edited by unauthorized users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the group owner on the "/etc/cron.allow" file to root with the following command: -- --# chgrp root /etc/cron.allowVerify that the "cron.allow" file is group-owned by root. -- --Check the group owner of the "cron.allow" file with the following command: -- --# ls -al /etc/cron.allow ---rw------- 1 root root 6 Mar 5 2011 /etc/cron.allow -- --If the "cron.allow" file exists and has a group owner other than root, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021300The Oracle Linux operating system must disable Kernel core dumps unless needed.<VulnDiscussion>Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core dumps may consume a considerable amount of disk space, and may result in denial of service by exhausting the available space on the target file system partition.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366If kernel core dumps are not required, disable the "kdump" service with the following command: -- --# systemctl disable kdump.service -- --If kernel core dumps are required, document the need with the ISSO.Verify that kernel core dumps are disabled unless needed. -- --Check the status of the "kdump" service with the following command: -- --# systemctl status kdump.service --kdump.service - Crash recovery kernel arming --Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled) --Active: active (exited) since Wed 2015-08-26 13:08:09 EDT; 43min ago --Main PID: 1130 (code=exited, status=0/SUCCESS) --kernel arming. -- --If the "kdump" service is active, ask the System Administrator if the use of the service is required and documented with the Information System Security Officer (ISSO). -- --If the service is active and is not documented, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021310The Oracle Linux operating system must be configured so that a separate file system is used for user home directories (such as /home or an equivalent).<VulnDiscussion>The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Migrate the "/home" directory onto a separate file system/partition.Verify that a separate file system/partition has been created for non-privileged local interactive user home directories. -- --Check the home directory assignment for all non-privileged users (those with a UID greater than 1000) on the system with the following command: -- --#cut -d: -f 1,3,6,7 /etc/passwd | egrep ":[1-4][0-9]{3}" | tr ":" "\t" -- --adamsj /home/adamsj /bin/bash --jacksonm /home/jacksonm /bin/bash --smithj /home/smithj /bin/bash -- --The output of the command will give the directory/partition that contains the home directories for the non-privileged users on the system (in this example, /home) and users' shell. All accounts with a valid shell (such as /bin/bash) are considered interactive users. -- --Check that a file system/partition has been created for the non-privileged interactive users with the following command: -- --Note: The partition of /home is used in the example. -- --# grep /home /etc/fstab --UUID=333ada18 /home ext4 noatime,nobarrier,nodev 1 2 -- --If a separate entry for the file system/partition that contains the non-privileged interactive users' home directories does not exist, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021320The Oracle Linux operating system must use a separate file system for /var.<VulnDiscussion>The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Migrate the "/var" path onto a separate file system.Verify that a separate file system/partition has been created for "/var". -- --Check that a file system/partition has been created for "/var" with the following command: -- --# grep /var /etc/fstab --UUID=c274f65f /var ext4 noatime,nobarrier 1 2 -- --If a separate entry for "/var" is not in use, this is a finding.SRG-OS-000341-GPOS-00132<GroupDescription></GroupDescription>OL07-00-021330The Oracle Linux operating system must use a separate file system for the system audit data path large enough to hold at least one week of audit data.<VulnDiscussion>The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001849Migrate the system audit data path onto an appropriately sized separate file system to store at least one week of audit records.Determine if the operating system is configured to have the "/var/log/audit" path is on a separate file system. -- --# grep /var/log/audit /etc/fstab -- --If no result is returned, or the operating system is not configured to have "/var/log/audit" on a separate file system, this is a finding. -- --Verify that "/var/log/audit" is mounted on a separate file system: -- --# mount | grep "/var/log/audit" -- --If no result is returned, or "/var/log/audit" is not on a separate file system, this is a finding. -- --Verify the size of the audit file system: -- --# df -h /var/log/audit -- --If the size is insufficient for a week of audit data, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021340The Oracle Linux operating system must use a separate file system for /tmp (or equivalent).<VulnDiscussion>The use of separate file systems for different paths can protect the system from failures resulting from a file system becoming full or failing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Start the "tmp.mount" service with the following command: -- --# systemctl enable tmp.mount -- --OR -- --Edit the "/etc/fstab" file and ensure the "/tmp" directory is defined in the fstab with a device and mount point.Verify that a separate file system/partition has been created for "/tmp". -- --Check that a file system/partition has been created for "/tmp" with the following command: -- --# systemctl is-enabled tmp.mount --enabled -- --If the "tmp.mount" service is not enabled, check to see if "/tmp" is defined in the fstab with a device and mount point: -- --# grep -i /tmp /etc/fstab --UUID=a411dc99-f2a1-4c87-9e05-184977be8539 /tmp ext4 rw,relatime,discard,data=ordered,nosuid,noexec, 0 0 -- --If "tmp.mount" service is not enabled and the "/tmp" directory is not defined in the fstab with a device and mount point, this is a finding.SRG-OS-000033-GPOS-00014<GroupDescription></GroupDescription>OL07-00-021350The Oracle Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.<VulnDiscussion>Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The operating system must implement cryptographic modules that adhere to the higher standards approved by the federal government to ensure they have been tested and validated. -- --Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000185-GPOS-00079, SRG-OS-000396-GPOS-00176, SRG-OS-000405-GPOS-00184, SRG-OS-000478-GPOS-00223</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000068CCI-001199CCI-002450CCI-002476Configure the operating system to implement DoD-approved encryption by installing the dracut-fips package. -- --To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. -- --Configure the operating system to implement DoD-approved encryption by following the steps below: -- --The fips=1 kernel option needs to be added to the kernel command line during system installation so that key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Users should also ensure that the system has plenty of entropy during the installation process by moving the mouse around, or if no mouse is available, ensuring that many keystrokes are typed. The recommended amount of keystrokes is 256 and more. Less than 256 keystrokes may generate a non-unique key. -- --Install the dracut-fips package with the following command: -- --# yum install dracut-fips -- --Recreate the "initramfs" file with the following command: -- --Note: This command will overwrite the existing "initramfs" file. -- --# dracut -f -- --Modify the kernel command line of the current kernel in the "grub.cfg" file by adding the following option to the GRUB_CMDLINE_LINUX key in the "/etc/default/grub" file and then rebuild the "grub.cfg" file: -- --fips=1 -- --Changes to "/etc/default/grub" require rebuilding the "grub.cfg" file as follows: -- --On BIOS-based machines, use the following command: -- --# grub2-mkconfig -o /boot/grub2/grub.cfg -- --On UEFI-based machines, use the following command: -- --# grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg -- --If /boot or /boot/efi reside on separate partitions, the kernel parameter boot=<partition of /boot or /boot/efi> must be added to the kernel command line. You can identify a partition by running the df /boot or df /boot/efi command: -- --# df /boot --Filesystem 1K-blocks Used Available Use% Mounted on --/dev/sda1 495844 53780 416464 12% /boot -- --To ensure the "boot=" configuration option will work even if device naming changes occur between boots, identify the universally unique identifier (UUID) of the partition with the following command: -- --# blkid /dev/sda1 --/dev/sda1: UUID="05c000f1-a213-759e-c7a2-f11b7424c797" TYPE="ext4" -- --For the example above, append the following string to the kernel command line: -- --boot=UUID=05c000f1-a213-759e-c7a2-f11b7424c797 -- --Reboot the system for the changes to take effect.Verify the operating system implements DoD-approved encryption to protect the confidentiality of remote access sessions. -- --Check to see if the "dracut-fips" package is installed with the following command: -- --# yum list installed dracut-fips -- --dracut-fips-033-360.el7_2.x86_64.rpm -- --If a "dracut-fips" package is installed, check to see if the kernel command line is configured to use FIPS mode with the following command: -- --Note: GRUB 2 reads its configuration from the "/boot/grub2/grub.cfg" file on traditional BIOS-based machines and from the "/boot/efi/EFI/redhat/grub.cfg" file on UEFI machines. -- --# grep fips /boot/grub2/grub.cfg --/vmlinuz-3.8.0-0.40.el7.x86_64 root=/dev/mapper/rhel-root ro rd.md=0 rd.dm=0 rd.lvm.lv=rhel/swap crashkernel=auto rd.luks=0 vconsole.keymap=us rd.lvm.lv=rhel/root rhgb fips=1 quiet -- --If the kernel command line is configured to use FIPS mode, check to see if the system is in FIPS mode with the following command: -- --# cat /proc/sys/crypto/fips_enabled --1 -- --If a "dracut-fips" package is not installed, the kernel command line does not have a fips entry, or the system has a value of "0" for "fips_enabled" in "/proc/sys/crypto", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021600The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify Access Control Lists (ACLs).<VulnDiscussion>ACLs can provide permissions beyond those permitted through the file mode and must be verified by file integrity tools.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the file integrity tool to check file and directory ACLs. -- --If AIDE is installed, ensure the "acl" rule is present on all uncommented file and directory selection lists.Verify the file integrity tool is configured to verify ACLs. -- --Check to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command: -- --# yum list installed aide -- --If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. -- --If there is no application installed to perform file integrity checks, this is a finding. -- --Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc" directory. -- --Use the following command to determine if the file is in another location: -- --# find / -name aide.conf -- --Check the "aide.conf" file to determine if the "acl" rule has been added to the rule list being applied to the files and directories selection lists. -- --An example rule that includes the "acl" rule is below: -- --All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux --/bin All # apply the custom rule to the files in bin --/sbin All # apply the same custom rule to the files in sbin -- --If the "acl" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or ACLs are not being checked by another file integrity tool, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021610The Oracle Linux operating system must be configured so that the file integrity tool is configured to verify extended attributes.<VulnDiscussion>Extended attributes in file systems are used to contain arbitrary data and file metadata with security implications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the file integrity tool to check file and directory extended attributes. -- --If AIDE is installed, ensure the "xattrs" rule is present on all uncommented file and directory selection lists.Verify the file integrity tool is configured to verify extended attributes. -- --Check to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command: -- --# yum list installed aide -- --If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. -- --If there is no application installed to perform file integrity checks, this is a finding. -- --Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc" directory. -- --Use the following command to determine if the file is in another location: -- --# find / -name aide.conf -- --Check the "aide.conf" file to determine if the "xattrs" rule has been added to the rule list being applied to the files and directories selection lists. -- --An example rule that includes the "xattrs" rule follows: -- --All= p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux --/bin All # apply the custom rule to the files in bin --/sbin All # apply the same custom rule to the files in sbin -- --If the "xattrs" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or extended attributes are not being checked by another file integrity tool, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-021620The Oracle Linux operating system must use a file integrity tool that is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories.<VulnDiscussion>File integrity tools use cryptographic hashes for verifying file contents and directories have not been altered. These hashes must be FIPS 140-2 approved cryptographic hashes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the file integrity tool to use FIPS 140-2 cryptographic hashes for validating file and directory contents. -- --If AIDE is installed, ensure the "sha512" rule is present on all uncommented file and directory selection lists.Verify the file integrity tool is configured to use FIPS 140-2 approved cryptographic hashes for validating file contents and directories. -- --Note: If OL07-00-021350 is a finding, this is automatically a finding as the system cannot implement FIPS 140-2 approved cryptographic algorithms and hashes. -- --Check to see if Advanced Intrusion Detection Environment (AIDE) is installed on the system with the following command: -- --# yum list installed aide -- --If AIDE is not installed, ask the System Administrator how file integrity checks are performed on the system. -- --If there is no application installed to perform file integrity checks, this is a finding. -- --Note: AIDE is highly configurable at install time. These commands assume the "aide.conf" file is under the "/etc" directory. -- --Use the following command to determine if the file is in another location: -- --# find / -name aide.conf -- --Check the "aide.conf" file to determine if the "sha512" rule has been added to the rule list being applied to the files and directories selection lists. -- --An example rule that includes the "sha512" rule follows: -- --All=p+i+n+u+g+s+m+S+sha512+acl+xattrs+selinux --/bin All # apply the custom rule to the files in bin --/sbin All # apply the same custom rule to the files in sbin -- --If the "sha512" rule is not being used on all uncommented selection lines in the "/etc/aide.conf" file, or another file integrity tool is not using FIPS 140-2 approved cryptographic hashes for validating file contents and directories, this is a finding.SRG-OS-000364-GPOS-00151<GroupDescription></GroupDescription>OL07-00-021700The Oracle Linux operating system must not allow removable media to be used as the boot loader unless approved.<VulnDiscussion>Malicious users with removable boot media can gain access to a system configured to use removable media as the boot loader. If removable media is designed to be used as the boot loader, the requirement must be documented with the Information System Security Officer (ISSO).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001813Remove alternate methods of booting the system from removable media or document the configuration to boot from removable media with the ISSO.Verify the system is not configured to use a boot loader on removable media. -- --Note: GRUB 2 reads its configuration from the "/boot/grub2/grub.cfg" file on traditional BIOS-based machines and from the "/boot/efi/EFI/redhat/grub.cfg" file on UEFI machines. -- --Check for the existence of alternate boot loader configuration files with the following command: -- --# find / -name grub.cfg --/boot/grub2/grub.cfg -- --If a "grub.cfg" is found in any subdirectories other than "/boot/grub2" and "/boot/efi/EFI/redhat", ask the System Administrator if there is documentation signed by the ISSO to approve the use of removable media as a boot loader. -- --Check that the grub configuration file has the set root command in each menu entry with the following commands: -- --# grep -c menuentry /boot/grub2/grub.cfg --1 --# grep 'set root' /boot/grub2/grub.cfg --set root=(hd0,1) -- --If the system is using an alternate boot loader on removable media, and documentation does not exist approving the alternate configuration, this is a finding.SRG-OS-000095-GPOS-00049<GroupDescription></GroupDescription>OL07-00-021710The Oracle Linux operating system must not have the telnet-server package installed.<VulnDiscussion>It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. -- --Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). -- --Examples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000381Configure the operating system to disable non-essential capabilities by removing the telnet-server package from the system with the following command: -- --# yum remove telnet-serverVerify the operating system is configured to disable non-essential capabilities. The most secure way of ensuring a non-essential capability is disabled is not to install the capability. -- --The telnet service provides an unencrypted remote access service that does not provide for the confidentiality and integrity of user passwords or the remote session. -- --If a privileged user were to log on using this service, the privileged user password could be compromised. -- --Check to see if the telnet-server package is installed with the following command: -- --# yum list installed telnet-server -- --If the telnet-server package is installed, this is a finding.SRG-OS-000038-GPOS-00016<GroupDescription></GroupDescription>OL07-00-030000The Oracle Linux operating system must be configured so that auditing is configured to produce records containing information to establish what type of events occurred, where the events occurred, the source of the events, and the outcome of the events. These audit records must also identify individual identities of group account users.<VulnDiscussion>Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. -- --Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. -- --Associating event types with detected events in the operating system audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds, or identifying an improperly configured operating system. -- --Satisfies: SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000365-GPOS-00152, SRG-OS-000255-GPOS-00096</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000131CCI-000132CCI-000135CCI-001464CCI-001487CCI-001814Configure the operating system to produce audit records containing information to establish when (date and time) the events occurred. -- --Enable the auditd service with the following command: -- --# systemctl start auditd.serviceVerify the operating system produces audit records containing information to establish when (date and time) the events occurred. -- --Check to see if auditing is active by issuing the following command: -- --# systemctl is-active auditd.service --active -- --If the "auditd" status is not active, this is a finding.SRG-OS-000046-GPOS-00022<GroupDescription></GroupDescription>OL07-00-030010The Oracle Linux operating system must shut down upon audit processing failure unless availability is an overriding concern. If availability is a concern, the system must alert the designated staff (System Administrator [SA] and Information System Security Officer [ISSO] at a minimum) in the event of an audit processing failure.<VulnDiscussion>It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected. -- --Audit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. -- --This requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both. -- --Satisfies: SRG-OS-000046-GPOS-00022, SRG-OS-000047-GPOS-00023</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000139CCI-000140Configure the operating system to shut down in the event of an audit processing failure. -- --Add or correct the option to shut down the operating system with the following command: -- --# auditctl -f 2 -- --Edit the "/etc/audit/rules.d/audit.rules" file and add the following line: -- ---f 2 -- --If availability has been determined to be more important, and this decision is documented with the ISSO, configure the operating system to notify system administration staff and ISSO staff in the event of an audit processing failure with the following command: -- --# auditctl -f 1 -- --Edit the "/etc/audit/rules.d/audit.rules" file and add the following line: -- ---f 1 -- --Kernel log monitoring must also be configured to properly alert designated staff. -- --The audit daemon must be restarted for the changes to take effect.Confirm the audit configuration regarding how auditing processing failures are handled. -- --Check to see what level "auditctl" is set to with following command: -- --# auditctl -s | grep -i "fail" -- --failure 2 -- --If the value of "failure" is set to "2", the system is configured to panic (shut down) in the event of an auditing failure. -- --If the value of "failure" is set to "1", the system is configured only to send information to the kernel log regarding the failure. -- --If the "failure" setting is not set, this is a CAT I finding. -- --If the "failure" setting is set to any value other than "1" or "2", this is a CAT II finding. -- --If the "failure" setting is set to "1" but the availability concern is not documented or there is no monitoring of the kernel log, this is a CAT III finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030200The Oracle Linux operating system must be configured to use the au-remote plugin.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. -- --Off-loading is a common process in information systems with limited audit storage capacity. -- --Without the configuration of the "au-remote" plugin, the audisp-remote daemon will not off-load the logs from the system being audited. -- --Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Edit the /etc/audisp/plugins.d/au-remote.conf file and change the value of "active" to "yes". -- --The audit daemon must be restarted for changes to take effect: -- --# service auditd restartVerify the "au-remote" plugin is active on the system: -- --# grep "active" /etc/audisp/plugins.d/au-remote.conf -- --active = yes -- --If the "active" setting is not set to "yes", or the line is commented out, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030201The Oracle Linux operating system must configure the au-remote plugin to off-load audit logs using the audisp-remote daemon.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. -- --Off-loading is a common process in information systems with limited audit storage capacity. -- --Without the configuration of the "au-remote" plugin, the audisp-remote daemon will not off load the logs from the system being audited. -- --Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Edit the /etc/audisp/plugins.d/au-remote.conf file and add or update the following values: -- --direction = out --path = /sbin/audisp-remote --type = always -- --The audit daemon must be restarted for changes to take effect: -- --# service auditd restartVerify the "au-remote" plugin is configured to always off-load audit logs using the audisp-remote daemon: -- --# cat /etc/audisp/plugins.d/au-remote.conf | grep -v "^#" -- --active = yes --direction = out --path = /sbin/audisp-remote --type = always --format = string -- --If the "direction" setting is not set to "out", or the line is commented out, this is a finding. -- --If the "path" setting is not set to "/sbin/audisp-remote", or the line is commented out, this is a finding. -- --If the "type" setting is not set to "always", or the line is commented out, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030210The Oracle Linux operating system must take appropriate action when the audisp-remote buffer is full.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. -- --Off-loading is a common process in information systems with limited audit storage capacity. -- --When the remote buffer is full, audit logs will not be collected and sent to the central log server. -- --Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Edit the /etc/audisp/audispd.conf file and add or update the "overflow_action" option: -- --overflow_action = syslog -- --The audit daemon must be restarted for changes to take effect: -- --# service auditd restartVerify the audisp daemon is configured to take an appropriate action when the internal queue is full: -- --# grep "overflow_action" /etc/audisp/audispd.conf -- --overflow_action = syslog -- --If the "overflow_action" option is not "syslog", "single", or "halt", or the line is commented out, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030211The Oracle Linux operating system must label all off-loaded audit logs before sending them to the central log server.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. -- --Off-loading is a common process in information systems with limited audit storage capacity. -- --When audit logs are not labeled before they are sent to a central log server, the audit data will not be able to be analyzed and tied back to the correct system. -- --Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Edit the /etc/audisp/audispd.conf file and add or update the "name_format" option: -- --name_format = hostname -- --The audit daemon must be restarted for changes to take effect: -- --# service auditd restartVerify the audisp daemon is configured to label all off-loaded audit logs: -- --# grep "name_format" /etc/audisp/audispd.conf -- --name_format = hostname -- --If the "name_format" option is not "hostname", "fqd", or "numeric", or the line is commented out, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030300The Oracle Linux operating system must off-load audit records onto a different system or media from the system being audited.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. -- --Off-loading is a common process in information systems with limited audit storage capacity. -- --Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Configure the operating system to off-load audit records onto a different system or media from the system being audited. -- --Set the remote server option in "/etc/audisp/audisp-remote.conf" with the IP address of the log aggregation server.Verify the operating system off-loads audit records onto a different system or media from the system being audited. -- --To determine the remote server that the records are being sent to, use the following command: -- --# grep -i remote_server /etc/audisp/audisp-remote.conf --remote_server = 10.0.21.1 -- --If a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. -- --If there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030310The Oracle Linux operating system must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited.<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. -- --Off-loading is a common process in information systems with limited audit storage capacity. -- --Satisfies: SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Configure the operating system to encrypt the transfer of off-loaded audit records onto a different system or media from the system being audited. -- --Uncomment the "enable_krb5" option in "/etc/audisp/audisp-remote.conf" and set it with the following line: -- --enable_krb5 = yesVerify the operating system encrypts audit records off-loaded onto a different system or media from the system being audited. -- --To determine if the transfer is encrypted, use the following command: -- --# grep -i enable_krb5 /etc/audisp/audisp-remote.conf --enable_krb5 = yes -- --If the value of the "enable_krb5" option is not set to "yes" or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. -- --If there is no evidence that the transfer of the audit logs being off-loaded to another system or media is encrypted, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030320The Oracle Linux operating system must be configured so that the audit system takes appropriate action when the audit storage volume is full.<VulnDiscussion>Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Configure the action the operating system takes if the disk the audit records are written to becomes full. -- --Uncomment or edit the "disk_full_action" option in "/etc/audisp/audisp-remote.conf" and set it to "syslog", "single", or "halt", such as the following line: -- --disk_full_action = singleVerify the action the operating system takes if the disk the audit records are written to becomes full. -- --To determine the action that takes place if the disk is full on the remote server, use the following command: -- --# grep -i disk_full_action /etc/audisp/audisp-remote.conf --disk_full_action = single -- --If the value of the "disk_full_action" option is not "syslog", "single", or "halt", or the line is commented out, this is a finding.SRG-OS-000342-GPOS-00133<GroupDescription></GroupDescription>OL07-00-030321The Oracle Linux operating system must be configured so that the audit system takes appropriate action when there is an error sending audit records to a remote system.<VulnDiscussion>Taking appropriate action when there is an error sending audit records to a remote system will minimize the possibility of losing audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001851Configure the action the operating system takes if there is an error sending audit records to a remote system. -- --Uncomment the "network_failure_action" option in "/etc/audisp/audisp-remote.conf" and set it to "syslog", "single", or "halt". -- --network_failure_action = syslogVerify the action the operating system takes if there is an error sending audit records to a remote system. -- --Check the action that takes place if there is an error sending audit records to a remote system with the following command: -- --# grep -i network_failure_action /etc/audisp/audisp-remote.conf --network_failure_action = syslog -- --If the value of the "network_failure_action" option is not "syslog", "single", or "halt", or the line is commented out, this is a finding.SRG-OS-000343-GPOS-00134<GroupDescription></GroupDescription>OL07-00-030330The Oracle Linux operating system must initiate an action to notify the System Administrator (SA) and Information System Security Officer (ISSO), at a minimum, when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity.<VulnDiscussion>If security personnel are not notified immediately when storage volume reaches 75 percent utilization, they are unable to plan for audit record storage capacity expansion.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001855Configure the operating system to initiate an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. -- --Check the system configuration to determine the partition the audit records are being written to: -- --# grep -iw log_file /etc/audit/auditd.conf -- --Determine the size of the partition that audit records are written to (with the example being "/var/log/audit/"): -- --# df -h /var/log/audit/ -- --Set the value of the "space_left" keyword in "/etc/audit/auditd.conf" to 75 percent of the partition size.Verify the operating system initiates an action to notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. -- --Check the system configuration to determine the partition the audit records are being written to with the following command: -- --# grep -iw log_file /etc/audit/auditd.conf --log_file = /var/log/audit/audit.log -- --Check the size of the partition that audit records are written to (with the example being "/var/log/audit/"): -- --# df -h /var/log/audit/ --0.9G /var/log/audit -- --If the audit records are not being written to a partition specifically created for audit records (in this example "/var/log/audit" is a separate partition), determine the amount of space other files in the partition are currently occupying with the following command: -- --# du -sh <partition> --1.8G /var -- --Determine what the threshold is for the system to take action when 75 percent of the repository maximum audit record storage capacity is reached: -- --# grep -iw space_left /etc/audit/auditd.conf --space_left = 225 -- --If the value of the "space_left" keyword is not set to 75 percent of the total partition size, this is a finding.SRG-OS-000343-GPOS-00134<GroupDescription></GroupDescription>OL07-00-030340The Oracle Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached.<VulnDiscussion>If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001855Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached. -- --Uncomment or edit the "space_left_action" keyword in "/etc/audit/auditd.conf" and set it to "email". -- --space_left_action = emailVerify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the allocated audit record storage volume reaches 75 percent of the repository maximum audit record storage capacity. -- --Check what action the operating system takes when the threshold for the repository maximum audit record storage capacity is reached with the following command: -- --# grep -i space_left_action /etc/audit/auditd.conf --space_left_action = email -- --If the value of the "space_left_action" keyword is not set to "email", this is a finding.SRG-OS-000343-GPOS-00134<GroupDescription></GroupDescription>OL07-00-030350The Oracle Linux operating system must immediately notify the System Administrator (SA) and Information System Security Officer (ISSO) (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached.<VulnDiscussion>If security personnel are not notified immediately when the threshold for the repository maximum audit record storage capacity is reached, they are unable to expand the audit record storage capacity before records are lost.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001855Configure the operating system to immediately notify the SA and ISSO (at a minimum) when the threshold for the repository maximum audit record storage capacity is reached. -- --Uncomment or edit the "action_mail_acct" keyword in "/etc/audit/auditd.conf" and set it to root and any other accounts associated with security personnel. -- --action_mail_acct = rootVerify the operating system immediately notifies the SA and ISSO (at a minimum) via email when the threshold for the repository maximum audit record storage capacity is reached. -- --Check what account the operating system emails when the threshold for the repository maximum audit record storage capacity is reached with the following command: -- --# grep -i action_mail_acct /etc/audit/auditd.conf --action_mail_acct = root -- --If the value of the "action_mail_acct" keyword is not set to "root" and other accounts for security personnel, this is a finding.SRG-OS-000327-GPOS-00127<GroupDescription></GroupDescription>OL07-00-030360The Oracle Linux operating system must audit all executions of privileged functions.<VulnDiscussion>Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002234Configure the operating system to audit the execution of privileged functions. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid ---a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid ---a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid ---a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system audits the execution of privileged functions using the following command: -- --# grep -iw execve /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k setuid ---a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k setuid ---a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k setgid ---a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k setgid -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. --Only the lines appropriate for the system architecture must be present. -- --If the audit rule for "SUID" files is not defined, this is a finding. -- --If the audit rule for "SGID" files is not defined, this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030370The Oracle Linux operating system must audit all uses of the chown syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chown" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw chown /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "chown" syscall, this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030380The Oracle Linux operating system must audit all uses of the fchown syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "fchown" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw fchown /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "fchown" syscall, this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030390The Oracle Linux operating system must audit all uses of the lchown syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "lchown" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw lchown /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "lchown" syscall, this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030400The Oracle Linux operating system must audit all uses of the fchownat syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "fchownat" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw fchownat /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "fchownat" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030410The Oracle Linux operating system must audit all uses of the chmod syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chmod" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chmod" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following command: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw chmod /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "chmod" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030420The Oracle Linux operating system must audit all uses of the fchmod syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fchmod" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "fchmod" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following command: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw fchmod /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "fchmod" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030430The Oracle Linux operating system must audit all uses of the fchmodat syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fchmodat" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "fchmodat" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following command: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw fchmodat /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "fchmodat" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030440The Oracle Linux operating system must audit all uses of the setxattr syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setxattr" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "setxattr" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw setxattr /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "setxattr" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030450The Oracle Linux operating system must audit all uses of the fsetxattr syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fsetxattr" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "fsetxattr" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw fsetxattr /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "fsetxattr" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030460The Oracle Linux operating system must audit all uses of the lsetxattr syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "lsetxattr" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "lsetxattr" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw lsetxattr /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "lsetxattr" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030470The Oracle Linux operating system must audit all uses of the removexattr syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "removexattr" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "removexattr" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw removexattr /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "removexattr" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030480The Oracle Linux operating system must audit all uses of the fremovexattr syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "fremovexattr" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "fremovexattr" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw fremovexattr /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "fremovexattr" syscall, this is a finding.SRG-OS-000458-GPOS-00203<GroupDescription></GroupDescription>OL07-00-030490The Oracle Linux operating system must audit all uses of the lremovexattr syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000458-GPOS-00203, SRG-OS-000392-GPOS-00172, SRG-OS-000064-GPOS-00033</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "lremovexattr" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "lremovexattr" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw lremovexattr /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- ---a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=4294967295 -k perm_mod -- --If there are no audit rules defined for the "lremovexattr" syscall, this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030500The Oracle Linux operating system must audit all uses of the creat syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "creat" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules: -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "creat" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw creat /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S creat F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S creat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S creat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --If there are no audit rules defined for the "creat" syscall, this is a finding. -- --If the output does not produce a rule containing "-F exit=-EPERM", this is a finding. -- --If the output does not produce a rule containing "-F exit=-EACCES", this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030510The Oracle Linux operating system must audit all uses of the open syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "open" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "open" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw open /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --If there are no audit rules defined for the "open" syscall, this is a finding. -- --If the output does not produce a rule containing "-F exit=-EPERM", this is a finding. -- --If the output does not produce a rule containing "-F exit=-EACCES", this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030520The Oracle Linux operating system must audit all uses of the openat syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "openat" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "openat" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw openat /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --If there are no audit rules defined for the "openat" syscall, this is a finding. -- --If the output does not produce a rule containing "-F exit=-EPERM", this is a finding. -- --If the output does not produce a rule containing "-F exit=-EACCES", this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030530The Oracle Linux operating system must audit all uses of the open_by_handle_at syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "open_by_handle_at" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "open_by_handle_at" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw open_by_handle_at /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --If there are no audit rules defined for the "open_by_handle_at" syscall, this is a finding. -- --If the output does not produce a rule containing "-F exit=-EPERM", this is a finding. -- --If the output does not produce a rule containing "-F exit=-EACCES", this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030540The Oracle Linux operating system must audit all uses of the truncate syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "truncate" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "truncate" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw truncate /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --If there are no audit rules defined for the "truncate" syscall, this is a finding. -- --If the output does not produce a rule containing "-F exit=-EPERM", this is a finding. -- --If the output does not produce a rule containing "-F exit=-EACCES", this is a finding.SRG-OS-000064-GPOS-00033<GroupDescription></GroupDescription>OL07-00-030550The Oracle Linux operating system must audit all uses of the ftruncate syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "ftruncate" syscall occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "ftruncate" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw ftruncate /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access -- ---a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -k access -- --If there are no audit rules defined for the "ftruncate" syscall, this is a finding. -- --If the output does not produce a rule containing "-F exit=-EPERM", this is a finding. -- --If the output does not produce a rule containing "-F exit=-EACCES", this is a finding.SRG-OS-000392-GPOS-00172<GroupDescription></GroupDescription>OL07-00-030560The Oracle Linux operating system must audit all uses of the semanage command.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172CCI-002884Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "semanage" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "semanage" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -i /usr/sbin/semanage /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/semanage -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000392-GPOS-00172<GroupDescription></GroupDescription>OL07-00-030570The Oracle Linux operating system must audit all uses of the setsebool command.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002884Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setsebool" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "setsebool" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -i /usr/sbin/setsebool /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/setsebool -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000392-GPOS-00172<GroupDescription></GroupDescription>OL07-00-030580The Oracle Linux operating system must audit all uses of the chcon command.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002884Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chcon" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chcon" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -i /usr/bin/chcon /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/chcon -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000392-GPOS-00172<GroupDescription></GroupDescription>OL07-00-030590The Oracle Linux operating system must audit all uses of the setfiles command.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002884Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "setfiles" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "setfiles" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -iw /usr/sbin/setfiles /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/setfiles -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000392-GPOS-00172<GroupDescription></GroupDescription>OL07-00-030610The Oracle Linux operating system must generate audit records for all unsuccessful account access events.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172CCI-002884Configure the operating system to generate audit records when unsuccessful account access events occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---w /var/run/faillock -p wa -k logins -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when unsuccessful account access events occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following commands: -- --# grep -i /var/run/faillock /etc/audit/audit.rules -- ---w /var/run/faillock -p wa -k logins -- --If the command does not return any output, this is a finding.SRG-OS-000392-GPOS-00172<GroupDescription></GroupDescription>OL07-00-030620The Oracle Linux operating system must generate audit records for all successful account access events.<VulnDiscussion>Without generating audit records that to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000470-GPOS-00214, SRG-OS-000473-GPOS-00218</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172CCI-002884Configure the operating system to generate audit records when successful account access events occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---w /var/log/lastlog -p wa -k logins -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful account access events occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --# grep -i /var/log/lastlog /etc/audit/audit.rules -- ---w /var/log/lastlog -p wa -k logins -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030630The Oracle Linux operating system must audit all uses of the passwd command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "passwd" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "passwd" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -i /usr/bin/passwd /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/passwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030640The Oracle Linux operating system must audit all uses of the unix_chkpwd command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unix_chkpwd" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "unix_chkpwd" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -iw /usr/sbin/unix_chkpwd /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/unix_chkpwd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030650The Oracle Linux operating system must audit all uses of the gpasswd command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "gpasswd" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "gpasswd" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -i /usr/bin/gpasswd /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/gpasswd -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030660The Oracle Linux operating system must audit all uses of the chage command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chage" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chage" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -i /usr/bin/chage /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/chage -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030670The Oracle Linux operating system must audit all uses of the userhelper command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged password commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "userhelper" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "userhelper" command occur. -- --Check the file system rule in "/etc/audit/audit.rules" with the following command: -- --# grep -i /usr/sbin/userhelper /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/userhelper -F auid>=1000 -F auid!=4294967295 -k privileged-passwd -- --If the command does not return any output, this is a finding.SRG-OS-000037-GPOS-00015<GroupDescription></GroupDescription>OL07-00-030680The Oracle Linux operating system must audit all uses of the su command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000130CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "su" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "su" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw /usr/bin/su /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/su -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000037-GPOS-00015<GroupDescription></GroupDescription>OL07-00-030690The Oracle Linux operating system must audit all uses of the sudo command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000130CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "sudo" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "sudo" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw /usr/bin/sudo /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/sudo -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000037-GPOS-00015<GroupDescription></GroupDescription>OL07-00-030700The Oracle Linux operating system must audit all uses of the sudoers file and all files in the /etc/sudoers.d/ directory.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000130CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---w /etc/sudoers -p wa -k privileged-actions -- ---w /etc/sudoers.d/ -p wa -k privileged-actions -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to access the "/etc/sudoers" file and files in the "/etc/sudoers.d/" directory. -- --Check for modification of the following files being audited by performing the following commands to check the file system rules in "/etc/audit/audit.rules": -- --# grep -i "/etc/sudoers" /etc/audit/audit.rules -- ---w /etc/sudoers -p wa -k privileged-actions -- --# grep -i "/etc/sudoers.d/" /etc/audit/audit.rules -- ---w /etc/sudoers.d/ -p wa -k privileged-actions -- --If the commands do not return output that match the examples, this is a finding.SRG-OS-000037-GPOS-00015<GroupDescription></GroupDescription>OL07-00-030710The Oracle Linux operating system must audit all uses of the newgrp command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000130CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "newgrp" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "newgrp" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -i /usr/bin/newgrp /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/newgrp -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000037-GPOS-00015<GroupDescription></GroupDescription>OL07-00-030720The Oracle Linux operating system must audit all uses of the chsh command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged access commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000130Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "chsh" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "chsh" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -i /usr/bin/chsh /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/chsh -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030740The Oracle Linux operating system must audit all uses of the mount command and syscall.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur. -- --Add or update the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount ---a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount ---a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "mount" command and syscall occur. -- --Check that the following system call is being audited by performing the following series of commands to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw "mount" /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount ---a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount ---a always,exit -F path=/usr/bin/mount -F auid>=1000 -F auid!=4294967295 -k privileged-mount -- --If all uses of the "mount" command and syscall are not being audited, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030750The Oracle Linux operating system must audit all uses of the umount command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged mount commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "umount" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "umount" command occur. -- --Check that the following system call is being audited by performing the following series of commands to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw "/usr/bin/umount" /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/umount -F auid>=1000 -F auid!=4294967295 -k privileged-mount -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030760The Oracle Linux operating system must audit all uses of the postdrop command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "postdrop" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "postdrop" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw /usr/sbin/postdrop /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/postdrop -F auid>=1000 -F auid!=4294967295 -k privileged-postfix -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030770The Oracle Linux operating system must audit all uses of the postqueue command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged postfix commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "postqueue" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "postqueue" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw /usr/sbin/postqueue /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/postqueue -F auid>=1000 -F auid!=4294967295 -k privileged-postfix -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030780The Oracle Linux operating system must audit all uses of the ssh-keysign command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged ssh commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "ssh-keysign" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "ssh-keysign" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw /usr/libexec/openssh/ssh-keysign /etc/audit/audit.rules -- ---a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F auid>=1000 -F auid!=4294967295 -k privileged-ssh -- --If the command does not return any output, this is a finding.SRG-OS-000042-GPOS-00020<GroupDescription></GroupDescription>OL07-00-030800The Oracle Linux operating system must audit all uses of the crontab command.<VulnDiscussion>Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. -- --At a minimum, the organization must audit the full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise. -- --Satisfies: SRG-OS-000042-GPOS-00020, SRG-OS-000392-GPOS-00172, SRG-OS-000471-GPOS-00215</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000135Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "crontab" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "crontab" command occur. -- --Check that the following system call is being audited by performing the following command to check the file system rules in "/etc/audit/audit.rules": -- --# grep -iw /usr/bin/crontab /etc/audit/audit.rules -- ---a always,exit -F path=/usr/bin/crontab -F auid>=1000 -F auid!=4294967295 -k privileged-cron -- --If the command does not return any output, this is a finding.SRG-OS-000471-GPOS-00215<GroupDescription></GroupDescription>OL07-00-030810The Oracle Linux operating system must audit all uses of the pam_timestamp_check command.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "pam_timestamp_check" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "pam_timestamp_check" command occur. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --# grep -iw "/usr/sbin/pam_timestamp_check" /etc/audit/audit.rules -- ---a always,exit -F path=/usr/sbin/pam_timestamp_check -F auid>=1000 -F auid!=4294967295 -k privileged-pam -- --If the command does not return any output, this is a finding.SRG-OS-000471-GPOS-00216<GroupDescription></GroupDescription>OL07-00-030819The Oracle Linux operating system must audit all uses of the create_module syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "create_module" syscall occur. -- --Add or update the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S create_module -k module-change -- ---a always,exit -F arch=b64 -S create_module -k module-change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "create_module" syscall occur. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the line appropriate for the system architecture must be present. -- --# grep -iw create_module /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S create_module -k module-change -- ---a always,exit -F arch=b64 -S create_module -k module-change -- --If there are no audit rules defined for "create_module", this is a finding.SRG-OS-000471-GPOS-00216<GroupDescription></GroupDescription>OL07-00-030820The Oracle Linux operating system must audit all uses of the init_module syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "init_module" syscall occur. -- --Add or update the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S init_module -k module-change -- ---a always,exit -F arch=b64 -S init_module -k module-change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "init_module" syscall occur. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the line appropriate for the system architecture must be present. -- --# grep -iw init_module /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S init_module -k module-change -- ---a always,exit -F arch=b64 -S init_module -k module-change -- --If there are no audit rules defined for "init_module", this is a finding.SRG-OS-000471-GPOS-00216<GroupDescription></GroupDescription>OL07-00-030821The Oracle Linux operating system must audit all uses of the finit_module syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "finit_module" syscall occur. -- --Add or update the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. ---a always,exit -F arch=b32 -S finit_module -k module-change -- ---a always,exit -F arch=b64 -S finit_module -k module-change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "finit_module" syscall occur. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the line appropriate for the system architecture must be present. -- --# grep -iw finit_module /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S finit_module -k module-change -- ---a always,exit -F arch=b64 -S finit_module -k module-change -- --If there are no audit rules defined for "finit_module", this is a finding.SRG-OS-000471-GPOS-00216<GroupDescription></GroupDescription>OL07-00-030830The Oracle Linux operating system must audit all uses of the delete_module syscall.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "delete_module" syscall occur. -- --Add or update the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S delete_module -k module-change -- ---a always,exit -F arch=b64 -S delete_module -k module-change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "delete_module" syscall occur. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the line appropriate for the system architecture must be present. -- --# grep -iw delete_module /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S delete_module -k module-change -- ---a always,exit -F arch=b64 -S delete_module -k module-change -- --If there are no audit rules defined for "delete_module", this is a finding.SRG-OS-000471-GPOS-00216<GroupDescription></GroupDescription>OL07-00-030840The Oracle Linux operating system must audit all uses of the kmod command.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000471-GPOS-00216, SRG-OS-000477-GPOS-00222</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "kmod" command occur. -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "kmod" command occur. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --# grep -iw kmod /etc/audit/audit.rules -- ---w /usr/bin/kmod -p x -F auid!=4294967295 -k module-change -- --If the command does not return any output, this is a finding.SRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>OL07-00-030870The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/passwd.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter). -- --Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000476-GPOS-00221</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000018CCI-000172CCI-001403CCI-001404CCI-001405CCI-002130Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". -- --Add or update the following rule "/etc/audit/rules.d/audit.rules": -- ---w /etc/passwd -p wa -k identity -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/passwd". -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --# grep /etc/passwd /etc/audit/audit.rules -- ---w /etc/passwd -p wa -k identity -- --If the command does not return a line, or the line is commented out, this is a finding.SRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>OL07-00-030871The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/group.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000018Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---w /etc/group -p wa -k identity -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/group". -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --# grep /etc/group /etc/audit/audit.rules -- ---w /etc/group -p wa -k identity -- --If the command does not return a line, or the line is commented out, this is a finding.SRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>OL07-00-030872The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/gshadow.<VulnDiscussion>Without generating audit specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000018Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". -- --Add or update the following rule in "/etc/audit/rules.d/audit.rules": -- ---w /etc/gshadow -p wa -k identity -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect "/etc/gshadow". -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --# grep /etc/gshadow /etc/audit/audit.rules -- ---w /etc/gshadow -p wa -k identity -- --If the command does not return a line, or the line is commented out, this is a finding.SRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>OL07-00-030873The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000018Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. -- --Add or update the following file system rule in "/etc/audit/rules.d/audit.rules": -- ---w /etc/shadow -p wa -k identity -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/shadow. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --# grep /etc/shadow /etc/audit/audit.rules -- ---w /etc/shadow -p wa -k identity -- --If the command does not return a line, or the line is commented out, this is a finding.SRG-OS-000004-GPOS-00004<GroupDescription></GroupDescription>OL07-00-030874The Oracle Linux operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd.<VulnDiscussion>Without generating audit records specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. -- --Audit records can be generated from various components within the information system (e.g., module or policy filter).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000018Configure the operating system to generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd. -- --Add or update the following file system rule in "/etc/audit/rules.d/audit.rules": -- ---w /etc/security/opasswd -p wa -k identity -- --The audit daemon must be restarted for the changes to take effect: --# systemctl restart auditdVerify the operating system must generate audit records for all account creations, modifications, disabling, and termination events that affect /etc/opasswd. -- --Check the auditing rules in "/etc/audit/audit.rules" with the following command: -- --# grep /etc/security/opasswd /etc/audit/audit.rules -- ---w /etc/security/opasswd -p wa -k identity -- --If the command does not return a line, or the line is commented out, this is a finding.SRG-OS-000466-GPOS-00210<GroupDescription></GroupDescription>OL07-00-030880The Oracle Linux operating system must audit all uses of the rename syscall.<VulnDiscussion>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. -- --Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "rename" syscall occur. -- --Add the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "rename" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw rename /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S rename -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S rename -F auid>=1000 -F auid!=4294967295 -k delete -- --If there are no audit rules defined for the "rename" syscall, this is a finding.SRG-OS-000466-GPOS-00210<GroupDescription></GroupDescription>OL07-00-030890The Oracle Linux operating system must audit all uses of the renameat syscall.<VulnDiscussion>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. -- --Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "renameat" syscall occur. -- --Add the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "renameat" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw renameat /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S renameat -F auid>=1000 -F auid!=4294967295 -k delete -- --If there are no audit rules defined for the "renameat" syscall, this is a finding.SRG-OS-000466-GPOS-00210<GroupDescription></GroupDescription>OL07-00-030900The Oracle Linux operating system must audit all uses of the rmdir syscall.<VulnDiscussion>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. -- --Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "rmdir" syscall occur. -- --Add the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "rmdir" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw rmdir /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S rmdir -F auid>=1000 -F auid!=4294967295 -k delete -- --If there are no audit rules defined for the "rmdir" syscall, this is a finding.SRG-OS-000466-GPOS-00210<GroupDescription></GroupDescription>OL07-00-030910The Oracle Linux operating system must audit all uses of the unlink syscall.<VulnDiscussion>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. -- --Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unlink" syscall occur. -- --Add the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "unlink" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw unlink /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S unlink -F auid>=1000 -F auid!=4294967295 -k delete -- --If there are no audit rules defined for the "unlink" syscall, this is a finding.SRG-OS-000466-GPOS-00210<GroupDescription></GroupDescription>OL07-00-030920The Oracle Linux operating system must audit all uses of the unlinkat syscall.<VulnDiscussion>If the system is not configured to audit certain activities and write them to an audit log, it is more difficult to detect and track system compromises and damages incurred during a system compromise. -- --Satisfies: SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00210, SRG-OS-000468-GPOS-00212, SRG-OS-000392-GPOS-00172</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000172Configure the operating system to generate audit records when successful/unsuccessful attempts to use the "unlinkat" syscall occur. -- --Add the following rules in "/etc/audit/rules.d/audit.rules": -- --Note: The rules are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be configured. -- ---a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete -- --The audit daemon must be restarted for the changes to take effect.Verify the operating system generates audit records when successful/unsuccessful attempts to use the "unlinkat" syscall occur. -- --Check the file system rules in "/etc/audit/audit.rules" with the following commands: -- --Note: The output lines of the command are duplicated to cover both 32-bit and 64-bit architectures. Only the lines appropriate for the system architecture must be present. -- --# grep -iw unlinkat /etc/audit/audit.rules -- ---a always,exit -F arch=b32 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete -- ---a always,exit -F arch=b64 -S unlinkat -F auid>=1000 -F auid!=4294967295 -k delete -- --If there are no audit rules defined for the "unlinkat" syscall, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-031000The Oracle Linux operating system must send rsyslog output to a log aggregation server.<VulnDiscussion>Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Modify the "/etc/rsyslog.conf" or an "/etc/rsyslog.d/*.conf" file to contain a configuration line to send all "rsyslog" output to a log aggregation system: --*.* @@<log aggregation system name>Verify "rsyslog" is configured to send all messages to a log aggregation server. -- --Check the configuration of "rsyslog" with the following command: -- --Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf". -- --# grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf --*.* @@logagg.site.mil -- --If there are no lines in the "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files that contain the "@" or "@@" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all "rsyslog" output, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media. -- --If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-031010The Oracle Linux operating system must be configured so that the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.<VulnDiscussion>Unintentionally running a rsyslog server accepting remote messages puts the system at increased risk. Malicious rsyslog messages sent to the server could exploit vulnerabilities in the server software itself, could introduce misleading information in to the system's logs, or could fill the system's storage leading to a denial of service. -- --If the system is intended to be a log aggregation server its use must be documented with the ISSO.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Modify the "/etc/rsyslog.conf" file to remove the "ModLoad imtcp", "ModLoad imudp", and "ModLoad imrelp" configuration lines, or document the system as being used for log aggregation.Verify that the system is not accepting "rsyslog" messages from other systems unless it is documented as a log aggregation server. -- --Check the configuration of "rsyslog" with the following command: -- --# grep imtcp /etc/rsyslog.conf --$ModLoad imtcp --# grep imudp /etc/rsyslog.conf --$ModLoad imudp --# grep imrelp /etc/rsyslog.conf --$ModLoad imrelp -- --If any of the above modules are being loaded in the "/etc/rsyslog.conf" file, ask to see the documentation for the system being used for log aggregation. -- --If the documentation does not exist, or does not specify the server as a log aggregation system, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-032000The Oracle Linux operating system must use a virus scan program.<VulnDiscussion>Virus scanning software can be used to protect a system from penetration from computer viruses and to limit their spread through intermediate systems. -- --The virus scanning software should be configured to perform scans dynamically on accessed files. If this capability is not available, the system must be configured to scan, at a minimum, all altered files on the system on a daily basis. -- --If the system processes inbound SMTP mail, the virus scanner must be configured to scan all received mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Install an antivirus solution on the system.Verify an anti-virus solution is installed on the system. The anti-virus solution may be bundled with an approved host-based security solution. -- --If there is no anti-virus solution installed on the system, this is a finding.SRG-OS-000027-GPOS-00008<GroupDescription></GroupDescription>OL07-00-040000The Oracle Linux operating system must limit the number of concurrent sessions to 10 for all accounts and/or account types.<VulnDiscussion>Operating system management includes the ability to control the number of users and user sessions that utilize an operating system. Limiting the number of allowed users and sessions per user is helpful in reducing the risks related to DoS attacks. -- --This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000054Configure the operating system to limit the number of concurrent sessions to 10 for all accounts and/or account types. -- --Add the following line to the top of the /etc/security/limits.conf: -- --* hard maxlogins 10Verify the operating system limits the number of concurrent sessions to 10 for all accounts and/or account types by issuing the following command: -- --# grep "maxlogins" /etc/security/limits.conf --* hard maxlogins 10 -- --This can be set as a global domain (with the * wildcard) but may be set differently for multiple domains. -- --If the "maxlogins" item is missing, commented out, or the value is not set to 10 or less for all domains that have the "maxlogins" item assigned, this is a finding.SRG-OS-000096-GPOS-00050<GroupDescription></GroupDescription>OL07-00-040100The Oracle Linux operating system must be configured to prohibit or restrict the use of functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA) and vulnerability assessments.<VulnDiscussion>In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems. -- --Operating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component. -- --To support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues. -- --Satisfies: SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000382CCI-002314Update the host's firewall settings and/or running services to comply with the PPSM CLSA for the site or program and the PPSM CAL.Inspect the firewall configuration and running services to verify that it is configured to prohibit or restrict the use of functions, ports, protocols, and/or services that are unnecessary or prohibited. -- --Check which services are currently active with the following command: -- --# firewall-cmd --list-all --public (default, active) --interfaces: enp0s3 --sources: --services: dhcpv6-client dns http https ldaps rpc-bind ssh --ports: --masquerade: no --forward-ports: --icmp-blocks: --rich rules: -- --Ask the System Administrator for the site or program PPSM CLSA. Verify the services allowed by the firewall match the PPSM CLSA. -- --If there are additional ports, protocols, or services that are not in the PPSM CLSA, or ports, protocols, or services prohibited by the PPSM Category Assurance List (CAL), this is a finding.SRG-OS-000033-GPOS-00014<GroupDescription></GroupDescription>OL07-00-040110The Oracle Linux operating system must use a FIPS 140-2 approved cryptographic algorithm for SSH communications.<VulnDiscussion>Unapproved mechanisms for authentication to the cryptographic module are not verified, and therefore cannot be relied upon to provide confidentiality or integrity, resulting in the compromise of DoD data. -- --Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. -- --FIPS 140-2 is the current standard for validating mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general-purpose computing system. -- --Satisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000125-GPOS-00065, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173,SRG-OS-000394-GPOS-00174</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000068CCI-000803CCI-000877CCI-002890CCI-003123Configure SSH to use FIPS 140-2 approved cryptographic algorithms. -- --Add the following line (or modify the line to have the required value) to the "/etc/ssh/sshd_config" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). -- --Ciphers aes128-ctr,aes192-ctr,aes256-ctr -- --The SSH service must be restarted for changes to take effect.Verify the operating system uses mechanisms that meet the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. -- --Note: If OL07-00-021350 is a finding, this is automatically a finding, as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes. -- --The location of the "sshd_config" file may vary if a different daemon is in use. -- --Inspect the "Ciphers" configuration with the following command: -- --# grep -i ciphers /etc/ssh/sshd_config --Ciphers aes128-ctr,aes192-ctr,aes256-ctr -- --If any ciphers other than "aes128-ctr", "aes192-ctr", or "aes256-ctr" are listed, the "Ciphers" keyword is missing, or the returned line is commented out, this is a finding.SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>OL07-00-040160The Oracle Linux operating system must be configured so that all network connections associated with a communication session are terminated at the end of the session or after 10 minutes of inactivity from the user at a command prompt, except to fulfill documented and validated mission requirements.<VulnDiscussion>Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. -- --Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001133Configure the operating system to terminate all network connections associated with a communications session at the end of the session or after a period of inactivity. -- --Create a script to enforce the inactivity timeout (for example /etc/profile.d/tmout.sh) such as: -- --#!/bin/bash -- --TMOUT=600 --readonly TMOUT --export TMOUTVerify the operating system terminates all network connections associated with a communications session at the end of the session or based on inactivity. -- --Check the value of the system inactivity timeout with the following command: -- --# grep -i tmout /etc/profile.d/* -- --etc/profile.d/tmout.sh:TMOUT=600 -- --/etc/profile.d/tmout.sh:readonly TMOUT -- --/etc/profile.d/tmout.sh:export TMOUT -- --If "TMOUT" is not set to "600" or less in a script located in the /etc/profile.d/ directory to enforce session termination after inactivity, this is a finding.SRG-OS-000023-GPOS-00006<GroupDescription></GroupDescription>OL07-00-040170The Oracle Linux operating system must display the Standard Mandatory DoD Notice and Consent Banner immediately prior to, or as part of, remote access logon prompts.<VulnDiscussion>Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. -- --System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. -- --The banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: -- --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. -- --By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." -- --Satisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007 , SRG-OS-000228-GPOS-00088</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000048Configure the operating system to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the ssh. -- --Edit the "/etc/ssh/sshd_config" file to uncomment the banner keyword and configure it to point to a file that will contain the logon banner (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). An example configuration line is: -- --banner /etc/issue -- --Either create the file containing the banner or replace the text in the file with the Standard Mandatory DoD Notice and Consent Banner. The DoD required text is: -- --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." -- --The SSH service must be restarted for changes to take effect.Verify any publicly accessible connection to the operating system displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system. -- --Check for the location of the banner file being used with the following command: -- --# grep -i banner /etc/ssh/sshd_config -- --banner /etc/issue -- --This command will return the banner keyword and the name of the file that contains the ssh banner (in this case "/etc/issue"). -- --If the line is commented out, this is a finding. -- --View the file specified by the banner keyword to check that it matches the text of the Standard Mandatory DoD Notice and Consent Banner: -- --"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -- ---The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -- ---At any time, the USG may inspect and seize data stored on this IS. -- ---Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -- ---This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -- ---Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." -- --If the system does not display a graphical logon banner or the banner does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding. -- --If the text in the file does not match the Standard Mandatory DoD Notice and Consent Banner, this is a finding.SRG-OS-000250-GPOS-00093<GroupDescription></GroupDescription>OL07-00-040180The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) authentication communications.<VulnDiscussion>Without cryptographic integrity protections, information can be altered by unauthorized users without detection. -- --Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001453Configure the operating system to implement cryptography to protect the integrity of LDAP authentication sessions. -- --Add or modify the following line in "/etc/sssd/sssd.conf": -- --ldap_id_use_start_tls = trueIf LDAP is not being utilized, this requirement is Not Applicable. -- --Verify the operating system implements cryptography to protect the integrity of remote LDAP authentication sessions. -- --To determine if LDAP is being used for authentication, use the following command: -- --# systemctl status sssd.service --sssd.service - System Security Services Daemon --Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled) --Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago -- --If the "sssd.service" is "active", then LDAP is being used. To see if LDAP is configured to use TLS, use the following command: -- --# grep -i "start_tls" /etc/sssd/sssd.conf --ldap_id_use_start_tls = true -- --If the "ldap_id_use_start_tls" option is not "true", this is a finding.SRG-OS-000250-GPOS-00093<GroupDescription></GroupDescription>OL07-00-040190The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.<VulnDiscussion>Without cryptographic integrity protections, information can be altered by unauthorized users without detection. -- --Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001453Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions. -- --Add or modify the following line in "/etc/sssd/sssd.conf": -- --ldap_tls_reqcert = demandIf LDAP is not being utilized, this requirement is Not Applicable. -- --Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions. -- --To determine if LDAP is being used for authentication, use the following command: -- --# systemctl status sssd.service --sssd.service - System Security Services Daemon --Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled) --Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago -- --If the "sssd.service" is "active", then LDAP is being used. -- --Verify that the sssd service is configured to require the use of certificates: -- --# grep -i tls_reqcert /etc/sssd/sssd.conf --ldap_tls_reqcert = demand -- --If the "ldap_tls_reqcert" setting is missing, commented out, or does not exist, this is a finding. -- --If the "ldap_tls_reqcert" setting is not set to "demand" or "hard", this is a finding.SRG-OS-000250-GPOS-00093<GroupDescription></GroupDescription>OL07-00-040200The Oracle Linux operating system must implement cryptography to protect the integrity of Lightweight Directory Access Protocol (LDAP) communications.<VulnDiscussion>Without cryptographic integrity protections, information can be altered by unauthorized users without detection. -- --Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the key used to generate the hash.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001453Configure the operating system to implement cryptography to protect the integrity of LDAP remote access sessions. -- --Add or modify the following line in "/etc/sssd/sssd.conf": -- --ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crtIf LDAP is not being utilized, this requirement is Not Applicable. -- --Verify the operating system implements cryptography to protect the integrity of remote LDAP access sessions. -- --To determine if LDAP is being used for authentication, use the following command: -- --# systemctl status sssd.service --sssd.service - System Security Services Daemon --Loaded: loaded (/usr/lib/systemd/system/sssd.service; enabled; vendor preset: disabled) --Active: active (running) since Wed 2018-06-27 10:58:11 EST; 1h 50min ago -- --If the "sssd.service" is "active", then LDAP is being used. -- --Check that the path to the X.509 certificate for peer authentication with the following command: -- --# grep -i tls_cacert /etc/sssd/sssd.conf -- --ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt -- --Verify the "ldap_tls_cacert" option points to a file that contains the trusted CA certificate. -- --If this file does not exist, or the option is commented out or missing, this is a finding.SRG-OS-000433-GPOS-00193<GroupDescription></GroupDescription>OL07-00-040201The Oracle Linux operating system must implement virtual address space randomization.<VulnDiscussion>Address space layout randomization (ASLR) makes it more difficult for an attacker to predict the location of attack code introduced into a process's address space during an attempt at exploitation. Additionally, ASLR also makes it more difficult for an attacker to know the location of existing code in order to repurpose it using return-oriented programming (ROP) techniques.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002824Configure the operating system implement virtual address space randomization. -- --Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a config file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --kernel.randomize_va_space = 2 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the operating system implements virtual address space randomization. -- --# grep kernel.randomize_va_space /etc/sysctl.conf /etc/sysctl.d/* -- --kernel.randomize_va_space = 2 -- --If "kernel.randomize_va_space" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of "2", this is a finding. -- --Check that the operating system implements virtual address space randomization with the following command: -- --# /sbin/sysctl -a | grep kernel.randomize_va_space -- --kernel.randomize_va_space = 2 -- --If "kernel.randomize_va_space" does not have a value of "2", this is a finding.SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>OL07-00-040300The Oracle Linux operating system must be configured so that all networked systems have SSH installed.<VulnDiscussion>Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. -- --This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. -- --Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, logical means (cryptography) do not have to be employed, and vice versa. -- --Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002418CCI-002420CCI-002422Install SSH packages onto the host with the following commands: -- --# yum install openssh-server.x86_64Check to see if sshd is installed with the following command: -- --# yum list installed \*ssh\* --libssh2.x86_64 1.4.3-8.el7 @anaconda/7.1 --openssh.x86_64 6.6.1p1-11.el7 @anaconda/7.1 --openssh-server.x86_64 6.6.1p1-11.el7 @anaconda/7.1 -- --If the "SSH server" package is not installed, this is a finding.SRG-OS-000423-GPOS-00187<GroupDescription></GroupDescription>OL07-00-040310The Oracle Linux operating system must be configured so that all networked systems use SSH for confidentiality and integrity of transmitted and received information as well as information during preparation for transmission.<VulnDiscussion>Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. -- --This requirement applies to both internal and external networks and all types of information system components from which information can be transmitted (e.g., servers, mobile devices, notebook computers, printers, copiers, scanners, and facsimile machines). Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. -- --Protecting the confidentiality and integrity of organizational information can be accomplished by physical means (e.g., employing physical distribution systems) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. -- --Satisfies: SRG-OS-000423-GPOS-00187, SRG-OS-000423-GPOS-00188, SRG-OS-000423-GPOS-00189, SRG-OS-000423-GPOS-00190</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002418Configure the SSH service to automatically start after reboot with the following command: -- --# systemctl enable sshd.serviceVerify SSH is loaded and active with the following command: -- --# systemctl status sshd --sshd.service - OpenSSH server daemon --Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled) --Active: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago --Main PID: 1348 (sshd) --CGroup: /system.slice/sshd.service --1053 /usr/sbin/sshd -D -- --If "sshd" does not show a status of "active" and "running", this is a finding.SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>OL07-00-040320The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity, except to fulfill documented and validated mission requirements.<VulnDiscussion>Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. -- --Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. -- --Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001133CCI-002361Configure the operating system to terminate a user session automatically after inactivity time-outs have expired or at shutdown. -- --Add the following line (or modify the line to have the required value) to the "/etc/ssh/sshd_config" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): -- --ClientAliveInterval 600 -- --The SSH service must be restarted for changes to take effect.Verify the operating system automatically terminates a user session after inactivity time-outs have expired. -- --Check for the value of the "ClientAliveInterval" keyword with the following command: -- --# grep -iw clientaliveinterval /etc/ssh/sshd_config -- --ClientAliveInterval 600 -- --If "ClientAliveInterval" is not configured, commented out, or has a value of "0", this is a finding. -- --If "ClientAliveInterval" has a value that is greater than "600" and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040330The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using RSA rhosts authentication.<VulnDiscussion>Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the SSH daemon to not allow authentication using RSA rhosts authentication. -- --Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "no": -- --RhostsRSAAuthentication no -- --The SSH service must be restarted for changes to take effect.Check the version of the operating system with the following command: -- --# cat /etc/oracle-release -- --If the release is 7.4 or newer this requirement is Not Applicable. -- --Verify the SSH daemon does not allow authentication using RSA rhosts authentication. -- --To determine how the SSH daemon's "RhostsRSAAuthentication" option is set, run the following command: -- --# grep RhostsRSAAuthentication /etc/ssh/sshd_config --RhostsRSAAuthentication no -- --If the value is returned as "yes", the returned line is commented out, or no output is returned, this is a finding.SRG-OS-000163-GPOS-00072<GroupDescription></GroupDescription>OL07-00-040340The Oracle Linux operating system must be configured so that all network connections associated with SSH traffic terminate after a period of inactivity.<VulnDiscussion>Terminating an idle SSH session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle SSH session will also free up resources committed by the managed network element. -- --Terminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session. -- --Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001133Configure the operating system to terminate automatically a user session after inactivity time-outs have expired or at shutdown. -- --Add the following line (or modify the line to have the required value) to the "/etc/ssh/sshd_config" file (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): -- --ClientAliveCountMax 0 -- --The SSH service must be restarted for changes to take effect.Verify the operating system automatically terminates a user session after inactivity time-outs have expired. -- --Check for the value of the "ClientAliveCountMax" keyword with the following command: -- --# grep -i clientalivecount /etc/ssh/sshd_config --ClientAliveCountMax 0 -- --If "ClientAliveCountMax" is not set to "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040350The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using rhosts authentication.<VulnDiscussion>Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the SSH daemon to not allow authentication using known hosts authentication. -- --Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": -- --IgnoreRhosts yesVerify the SSH daemon does not allow authentication using known hosts authentication. -- --To determine how the SSH daemon's "IgnoreRhosts" option is set, run the following command: -- --# grep -i IgnoreRhosts /etc/ssh/sshd_config -- --IgnoreRhosts yes -- --If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040360The Oracle Linux operating system must display the date and time of the last successful account logon upon an SSH logon.<VulnDiscussion>Providing users with feedback on when account accesses via SSH last occurred facilitates user recognition and reporting of unauthorized account use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure SSH to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/sshd" or in the "sshd_config" file used by the system ("/etc/ssh/sshd_config" will be used in the example) (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). -- --Modify the "PrintLastLog" line in "/etc/ssh/sshd_config" to match the following: -- --PrintLastLog yes -- --The SSH service must be restarted for changes to "sshd_config" to take effect.Verify SSH provides users with feedback on when account accesses last occurred. -- --Check that "PrintLastLog" keyword in the sshd daemon configuration file is used and set to "yes" with the following command: -- --# grep -i printlastlog /etc/ssh/sshd_config --PrintLastLog yes -- --If the "PrintLastLog" keyword is set to "no", is missing, or is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040370The Oracle Linux operating system must not permit direct logons to the root account using remote access via SSH.<VulnDiscussion>Even though the communications channel may be encrypted, an additional layer of security is gained by extending the policy of not logging on directly as root. In addition, logging on with a user-specific account provides individual accountability of actions performed on the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure SSH to stop users from logging on remotely as the root user. -- --Edit the appropriate "/etc/ssh/sshd_config" file to uncomment or add the line for the "PermitRootLogin" keyword and set its value to "no" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): -- --PermitRootLogin no -- --The SSH service must be restarted for changes to take effect.Verify remote access using SSH prevents users from logging on directly as root. -- --Check that SSH prevents users from logging on directly as root with the following command: -- --# grep -i permitrootlogin /etc/ssh/sshd_config --PermitRootLogin no -- --If the "PermitRootLogin" keyword is set to "yes", is missing, or is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040380The Oracle Linux operating system must be configured so that the SSH daemon does not allow authentication using known hosts authentication.<VulnDiscussion>Configuring this setting for the SSH daemon provides additional assurance that remote logon via SSH will require a password, even in the event of misconfiguration elsewhere.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the SSH daemon to not allow authentication using known hosts authentication. -- --Add the following line in "/etc/ssh/sshd_config", or uncomment the line and set the value to "yes": -- --IgnoreUserKnownHosts yes -- --The SSH service must be restarted for changes to take effect.Verify the SSH daemon does not allow authentication using known hosts authentication. -- --To determine how the SSH daemon's "IgnoreUserKnownHosts" option is set, run the following command: -- --# grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config -- --IgnoreUserKnownHosts yes -- --If the value is returned as "no", the returned line is commented out, or no output is returned, this is a finding.SRG-OS-000074-GPOS-00042<GroupDescription></GroupDescription>OL07-00-040390The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use the SSHv2 protocol.<VulnDiscussion>SSHv1 is an insecure implementation of the SSH protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system. -- --Satisfies: SRG-OS-000074-GPOS-00042, SRG-OS-000480-GPOS-00227</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000197Remove all Protocol lines that reference version "1" in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor). The "Protocol" line must be as follows: -- --Protocol 2 -- --The SSH service must be restarted for changes to take effect.Check the version of the operating system with the following command: -- --# cat /etc/oracle-release -- --If the release is 7.4 or newer this requirement is Not Applicable. -- --Verify the SSH daemon is configured to only use the SSHv2 protocol. -- --Check that the SSH daemon is configured to only use the SSHv2 protocol with the following command: -- --# grep -i protocol /etc/ssh/sshd_config --Protocol 2 --#Protocol 1,2 -- --If any protocol line other than "Protocol 2" is uncommented, this is a finding.SRG-OS-000250-GPOS-00093<GroupDescription></GroupDescription>OL07-00-040400The Oracle Linux operating system must be configured so that the SSH daemon is configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.<VulnDiscussion>DoD information systems are required to use FIPS 140-2 approved cryptographic hash functions. The only SSHv2 hash algorithm meeting this requirement is SHA.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001453Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "MACs" keyword and set its value to "hmac-sha2-256" and/or "hmac-sha2-512" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): -- --MACs hmac-sha2-256,hmac-sha2-512 -- --The SSH service must be restarted for changes to take effect.Verify the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers. -- --Note: If OL07-00-021350 is a finding, this is automatically a finding, as the system cannot implement FIPS 140-2-approved cryptographic algorithms and hashes. -- --Check that the SSH daemon is configured to only use MACs employing FIPS 140-2-approved ciphers with the following command: -- --# grep -i macs /etc/ssh/sshd_config --MACs hmac-sha2-256,hmac-sha2-512 -- --If any ciphers other than "hmac-sha2-256" or "hmac-sha2-512" are listed or the returned line is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040410The Oracle Linux operating system must be configured so that the SSH public host key files have mode 0644 or less permissive.<VulnDiscussion>If a public host key file is modified by an unauthorized user, the SSH service may be compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Note: SSH public key files may be found in other directories on the system depending on the installation. -- --Change the mode of public host key files under "/etc/ssh" to "0644" with the following command: -- --# chmod 0644 /etc/ssh/*.key.pubVerify the SSH public host key files have mode 0644 or less permissive. -- --Note: SSH public key files may be found in other directories on the system depending on the installation. -- --The following command will find all SSH public key files on the system: -- --# find /etc/ssh -name '*.pub' -exec ls -lL {} \; -- ---rw-r--r-- 1 root root 618 Nov 28 06:43 ssh_host_dsa_key.pub ---rw-r--r-- 1 root root 347 Nov 28 06:43 ssh_host_key.pub ---rw-r--r-- 1 root root 238 Nov 28 06:43 ssh_host_rsa_key.pub -- --If any file has a mode more permissive than 0644, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040420The Oracle Linux operating system must be configured so that the SSH private host key files have mode 0640 or less permissive.<VulnDiscussion>If an unauthorized user obtains the private SSH host key file, the host could be impersonated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the mode of SSH private host key files under "/etc/ssh" to "0640" with the following command: -- --# chmod 0640 /path/to/file/ssh_host*keyVerify the SSH private host key files have mode 0640 or less permissive. -- --The following command will find all SSH private key files on the system and list their modes: -- --# find / -name '*ssh_host*key' | xargs ls -lL -- ---rw-r----- 1 root ssh_keys 668 Nov 28 06:43 ssh_host_dsa_key ---rw-r----- 1 root ssh_keys 582 Nov 28 06:43 ssh_host_key ---rw-r----- 1 root ssh_keys 887 Nov 28 06:43 ssh_host_rsa_key -- --If any file has a mode more permissive than 0640, this is a finding.SRG-OS-000364-GPOS-00151<GroupDescription></GroupDescription>OL07-00-040430The Oracle Linux operating system must be configured so that the SSH daemon does not permit Generic Security Service Application Program Interface (GSSAPI) authentication unless needed.<VulnDiscussion>GSSAPI authentication is used to provide additional authentication mechanisms to applications. Allowing GSSAPI authentication through SSH exposes the system's GSSAPI to remote hosts, increasing the attack surface of the system. GSSAPI authentication must be disabled unless needed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001813Uncomment the "GSSAPIAuthentication" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "no": -- --GSSAPIAuthentication no -- --The SSH service must be restarted for changes to take effect. -- --If GSSAPI authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.Verify the SSH daemon does not permit GSSAPI authentication unless approved. -- --Check that the SSH daemon does not permit GSSAPI authentication with the following command: -- --# grep -i gssapiauth /etc/ssh/sshd_config --GSSAPIAuthentication no -- --If the "GSSAPIAuthentication" keyword is missing, is set to "yes" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.SRG-OS-000364-GPOS-00151<GroupDescription></GroupDescription>OL07-00-040440The Oracle Linux operating system must be configured so that the SSH daemon does not permit Kerberos authentication unless needed.<VulnDiscussion>Kerberos authentication for SSH is often implemented using Generic Security Service Application Program Interface (GSSAPI). If Kerberos is enabled through SSH, the SSH daemon provides a means of access to the system's Kerberos implementation. Vulnerabilities in the system's Kerberos implementation may then be subject to exploitation. To reduce the attack surface of the system, the Kerberos authentication mechanism within SSH must be disabled for systems not using this capability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001813Uncomment the "KerberosAuthentication" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "no": -- --KerberosAuthentication no -- --The SSH service must be restarted for changes to take effect. -- --If Kerberos authentication is required, it must be documented, to include the location of the configuration file, with the ISSO.Verify the SSH daemon does not permit Kerberos to authenticate passwords unless approved. -- --Check that the SSH daemon does not permit Kerberos to authenticate passwords with the following command: -- --# grep -i kerberosauth /etc/ssh/sshd_config --KerberosAuthentication no -- --If the "KerberosAuthentication" keyword is missing, or is set to "yes" and is not documented with the Information System Security Officer (ISSO), or the returned line is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040450The Oracle Linux operating system must be configured so that the SSH daemon performs strict mode checking of home directory configuration files.<VulnDiscussion>If other users have access to modify user-specific SSH configuration files, they may be able to log on to the system as another user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Uncomment the "StrictModes" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "yes": -- --StrictModes yes -- --The SSH service must be restarted for changes to take effect.Verify the SSH daemon performs strict mode checking of home directory configuration files. -- --The location of the "sshd_config" file may vary if a different daemon is in use. -- --Inspect the "sshd_config" file with the following command: -- --# grep -i strictmodes /etc/ssh/sshd_config -- --StrictModes yes -- --If "StrictModes" is set to "no", is missing, or the returned line is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040460The Oracle Linux operating system must be configured so that the SSH daemon uses privilege separation.<VulnDiscussion>SSH daemon privilege separation causes the SSH process to drop root privileges when not needed, which would decrease the impact of software vulnerabilities in the unprivileged section.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Uncomment the "UsePrivilegeSeparation" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) and set the value to "sandbox" or "yes": -- --UsePrivilegeSeparation sandbox -- --The SSH service must be restarted for changes to take effect.Verify the SSH daemon performs privilege separation. -- --Check that the SSH daemon performs privilege separation with the following command: -- --# grep -i usepriv /etc/ssh/sshd_config -- --UsePrivilegeSeparation sandbox -- --If the "UsePrivilegeSeparation" keyword is set to "no", is missing, or the returned line is commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040470The Oracle Linux operating system must be configured so that the SSH daemon does not allow compression or only allows compression after successful authentication.<VulnDiscussion>If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Uncomment the "Compression" keyword in "/etc/ssh/sshd_config" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor) on the system and set the value to "delayed" or "no": -- --Compression no -- --The SSH service must be restarted for changes to take effect.Verify the SSH daemon performs compression after a user successfully authenticates. -- --Check that the SSH daemon performs compression after a user successfully authenticates with the following command: -- --# grep -i compression /etc/ssh/sshd_config --Compression delayed -- --If the "Compression" keyword is set to "yes", is missing, or the returned line is commented out, this is a finding.SRG-OS-000399-GPOS-00178<GroupDescription></GroupDescription>OL07-00-040480The operating system must request and perform data origin authentication verification and data integrity verification on the name/address resolution responses the system receives from authoritative sources.<VulnDiscussion>If data origin authentication and data integrity verification are not performed, the resultant response could be forged, it may have come from a poisoned cache, the packets could have been intercepted without the resolver's knowledge, or resource records could have been removed, which would result in query failure or DoS. Data origin authentication must be performed to thwart these types of attacks. -- --Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching Domain Name System (DNS) servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations. Information systems that use technologies other than the DNS to map between host/service names and network addresses provide other means to enable clients to verify the authenticity of response data. -- --This is not applicable if DNSSEC is not implemented on the local network. -- --Satisfies: SRG-OS-000399-GPOS-00178, SRG-OS-000400-GPOS-00179, SRG-OS-000401-GPOS-00180, SRG-OS-000402-GPOS-00181</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002465CCI-002466CCI-002467CCI-002468Configure the operating system to implement DNSSEC to protect the integrity of name/address resolution. -- --Install the unbound package: --# yum install unbound -- --To ensure unbound starts up every time the system boots, run the following command: --# systemctl enable unboundVerify the operating system implements DNSSEC to protect the integrity of name/address resolution. -- --Determine if the package "unbound" is installed via the following command: --# yum info unbound -- --If unbound is not installed, this is a finding. -- --If "unbound" is installed, determine whether the unbound daemon is running; enter the following command: --# systemctl status unbound | grep Active -- --If the output does not indicate the daemon is "active", this is a finding.SRG-OS-000355-GPOS-00143<GroupDescription></GroupDescription>OL07-00-040500The Oracle Linux operating system must, for networked systems, synchronize clocks with a server that is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS).<VulnDiscussion>Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate. -- --Synchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. -- --Organizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). -- --Satisfies: SRG-OS-000355-GPOS-00143, SRG-OS-000356-GPOS-00144</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001891CCI-002046Edit the "/etc/ntp.conf" file and add or update an entry to define "maxpoll" to "10" as follows: -- --server 0.rhel.pool.ntp.org iburst maxpoll 10 -- --If NTP was running and "maxpoll" was updated, the NTP service must be restarted: -- --# systemctl restart ntpd -- --If NTP was not running, it must be started: -- --# systemctl start ntpdCheck to see if NTP is running in continuous mode. -- --# ps -ef | grep ntp -- --If NTP is not running, this is a finding. -- --If the process is found, then check the "ntp.conf" file for the "maxpoll" option setting: -- --# grep maxpoll /etc/ntp.conf --server 0.rhel.pool.ntp.org iburst maxpoll 10 -- --If the option is set to "17" or is not set, this is a finding. -- --If the file does not exist, check the "/etc/cron.daily" subdirectory for a crontab file controlling the execution of the "ntpd -q" command. -- --# grep -i "ntpd -q" /etc/cron.daily/* --# ls -al /etc/cron.* | grep ntp --ntp -- --If a crontab file does not exist in the "/etc/cron.daily" that executes the "ntpd -q" command, this is a finding.SRG-OS-000420-GPOS-00186<GroupDescription></GroupDescription>OL07-00-040510The Oracle Linux operating system must protect against or limit the effects of Denial of Service (DoS) attacks by validating the operating system is implementing rate-limiting measures on impacted network interfaces.<VulnDiscussion>DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. -- --This requirement addresses the configuration of the operating system to mitigate the impact of DoS attacks that have occurred or are ongoing on system availability. For each system, known and potential DoS attacks must be identified and solutions for each type implemented. A variety of technologies exists to limit or, in some cases, eliminate the effects of DoS attacks (e.g., limiting processes or establishing memory partitions). Employing increased capacity and bandwidth, combined with service redundancy, may reduce the susceptibility to some DoS attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002385Set the system to implement rate-limiting measures by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.tcp_invalid_ratelimit = 500 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the operating system protects against or limits the effects of DoS attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces. -- --# grep 'net.ipv4.tcp_invalid_ratelimit' /etc/sysctl.conf /etc/sysctl.d/* -- --/etc/sysctl.conf:net.ipv4.tcp_invalid_ratelimit = 500 -- --If "net.ipv4.tcp_invalid_ratelimit" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out this is a finding. -- --Check that the operating system implements the value of the "tcp_invalid_ratelimit" variable with the following command: -- --# /sbin/sysctl -a | grep 'net.ipv4.tcp_invalid_ratelimit' --net.ipv4.tcp_invalid_ratelimit = 500 -- --If "net.ipv4.tcp_invalid_ratelimit" has a value of "0", this is a finding. -- --If "net.ipv4.tcp_invalid_ratelimit" has a value greater than "1000" and is not documented with the Information System Security Officer (ISSO), this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040520The Oracle Linux operating system must enable an application firewall, if available.<VulnDiscussion>Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network. -- --Satisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Ensure the operating system's application firewall is enabled. -- --Install the "firewalld" package, if it is not on the system, with the following command: -- --# yum install firewalld -- --Start the firewall via "systemctl" with the following command: -- --# systemctl start firewalldVerify the operating system enabled an application firewall. -- --Check to see if "firewalld" is installed with the following command: -- --# yum list installed firewalld --firewalld-0.3.9-11.el7.noarch.rpm -- --If the "firewalld" package is not installed, ask the System Administrator if another firewall application (such as iptables) is installed. -- --If an application firewall is not installed, this is a finding. -- --Check to see if the firewall is loaded and active with the following command: -- --# systemctl status firewalld --firewalld.service - firewalld - dynamic firewall daemon -- --Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled) --Active: active (running) since Tue 2014-06-17 11:14:49 CEST; 5 days ago -- --If "firewalld" does not show a status of "loaded" and "active", this is a finding. -- --Check the state of the firewall: -- --# firewall-cmd --state --running -- --If "firewalld" does not show a state of "running", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040530The Oracle Linux operating system must display the date and time of the last successful account logon upon logon.<VulnDiscussion>Providing users with feedback on when account accesses last occurred facilitates user recognition and reporting of unauthorized account use.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system to provide users with feedback on when account accesses last occurred by setting the required configuration options in "/etc/pam.d/postlogin". -- --Add the following line to the top of "/etc/pam.d/postlogin": -- --session required pam_lastlog.so showfailedVerify users are provided with feedback on when account accesses last occurred. -- --Check that "pam_lastlog" is used and not silent with the following command: -- --# grep pam_lastlog /etc/pam.d/postlogin --session required pam_lastlog.so showfailed -- --If "pam_lastlog" is missing from "/etc/pam.d/postlogin" file, or the silent option is present, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040540The Oracle Linux operating system must not contain .shosts files.<VulnDiscussion>The .shosts files are used to configure host-based authentication for individual users or the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Remove any found ".shosts" files from the system. -- --# rm /[path]/[to]/[file]/.shostsVerify there are no ".shosts" files on the system. -- --Check the system for the existence of these files with the following command: -- --# find / -name '*.shosts' -- --If any ".shosts" files are found on the system, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040550The Oracle Linux operating system must not contain shosts.equiv files.<VulnDiscussion>The shosts.equiv files are used to configure host-based authentication for the system via SSH. Host-based authentication is not sufficient for preventing unauthorized access to the system, as it does not require interactive identification and authentication of a connection request, or for the use of two-factor authentication.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Remove any found "shosts.equiv" files from the system. -- --# rm /[path]/[to]/[file]/shosts.equivVerify there are no "shosts.equiv" files on the system. -- --Check the system for the existence of these files with the following command: -- --# find / -name shosts.equiv -- --If any "shosts.equiv" files are found on the system, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040600At least two name servers must be configured for Oracle Linux operating systems using DNS resolution.<VulnDiscussion>To provide availability for name resolution services, multiple redundant name servers are mandated. A failure in name resolution could lead to the failure of security functions requiring name resolution, which may include time synchronization, centralized authentication, and remote system logging.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the operating system to use two or more name servers for DNS resolution. -- --Edit the "/etc/resolv.conf" file to uncomment or add the two or more "nameserver" option lines with the IP address of local authoritative name servers. If local host resolution is being performed, the "/etc/resolv.conf" file must be empty. An empty "/etc/resolv.conf" file can be created as follows: -- --# echo -n > /etc/resolv.conf -- --And then make the file immutable with the following command: -- --# chattr +i /etc/resolv.conf -- --If the "/etc/resolv.conf" file must be mutable, the required configuration must be documented with the Information System Security Officer (ISSO) and the file must be verified by the system file integrity tool.Determine whether the system is using local or DNS name resolution with the following command: -- --# grep hosts /etc/nsswitch.conf --hosts: files dns -- --If the DNS entry is missing from the host's line in the "/etc/nsswitch.conf" file, the "/etc/resolv.conf" file must be empty. -- --Verify the "/etc/resolv.conf" file is empty with the following command: -- --# ls -al /etc/resolv.conf ---rw-r--r-- 1 root root 0 Aug 19 08:31 resolv.conf -- --If local host authentication is being used and the "/etc/resolv.conf" file is not empty, this is a finding. -- --If the DNS entry is found on the host's line of the "/etc/nsswitch.conf" file, verify the operating system is configured to use two or more name servers for DNS resolution. -- --Determine the name servers used by the system with the following command: -- --# grep nameserver /etc/resolv.conf --nameserver 192.168.1.2 --nameserver 192.168.1.3 -- --If less than two lines are returned that are not commented out, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040610The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets.<VulnDiscussion>Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.all.accept_source_route = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl -systemVerify the system does not accept IPv4 source-routed packets. -- --# grep net.ipv4.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/* -- --net.ipv4.conf.all.accept_source_route = 0 -- --If "net.ipv4.conf.all.accept_source_route" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "0", this is a finding. -- --Check that the operating system implements the accept source route variable with the following command: -- --# /sbin/sysctl -a | grep net.ipv4.conf.all.accept_source_route --net.ipv4.conf.all.accept_source_route = 0 -- --If the returned line does not have a value of "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040611The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible on all interfaces.<VulnDiscussion>Enabling reverse path filtering drops packets with invalid source addresses received on the interface. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.all.rp_filter = 1 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system uses a reverse-path filter for IPv4: -- --# grep net.ipv4.conf.all.rp_filter /etc/sysctl.conf /etc/sysctl.d/* --net.ipv4.conf.all.rp_filter = 1 -- --If "net.ipv4.conf.all.rp_filter" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "1", this is a finding. -- --Check that the operating system implements the accept source route variable with the following command: -- --# /sbin/sysctl -a | grep net.ipv4.conf.all.rp_filter --net.ipv4.conf.all.rp_filter = 1 -- --If the returned line does not have a value of "1", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040612The Oracle Linux operating system must use a reverse-path filter for IPv4 network traffic when possible by default.<VulnDiscussion>Enabling reverse path filtering drops packets with invalid source addresses received on the interface. It should not be used on systems which are routers for complicated networks, but is helpful for end hosts and routers serving small networks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.default.rp_filter = 1 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system uses a reverse-path filter for IPv4: -- --# grep net.ipv4.conf.default.rp_filter /etc/sysctl.conf /etc/sysctl.d/* --net.ipv4.conf.default.rp_filter = 1 -- --If "net.ipv4.conf.default.rp_filter" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "1", this is a finding. -- --Check that the operating system implements the accept source route variable with the following command: -- --# /sbin/sysctl -a | grep net.ipv4.conf.default.rp_filter --net.ipv4.conf.default.rp_filter = 1 -- --If the returned line does not have a value of "1", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040620The Oracle Linux operating system must not forward Internet Protocol version 4 (IPv4) source-routed packets by default.<VulnDiscussion>Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv4 forwarding is enabled and the system is functioning as a router.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.default.accept_source_route = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system does not accept IPv4 source-routed packets by default. -- --# grep net.ipv4.conf.default.accept_source_route /etc/sysctl.conf /etc/sysctl.d/* --net.ipv4.conf.default.accept_source_route = 0 -- --If "net.ipv4.conf.default.accept_source_route" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "0", this is a finding. -- --Check that the operating system implements the accept source route variable with the following command: -- --# /sbin/sysctl -a | grep net.ipv4.conf.default.accept_source_route --net.ipv4.conf.default.accept_source_route = 0 -- --If the returned line does not have a value of "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040630The Oracle Linux operating system must not respond to Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) echoes sent to a broadcast address.<VulnDiscussion>Responding to broadcast (ICMP) echoes facilitates network mapping and provides a vector for amplification attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.icmp_echo_ignore_broadcasts = 1 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system does not respond to IPv4 ICMP echoes sent to a broadcast address. -- --# grep net.ipv4.icmp_echo_ignore_broadcasts /etc/sysctl.conf /etc/sysctl.d/* -- --If "net.ipv4.icmp_echo_ignore_broadcasts" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "1", this is a finding. -- --Check that the operating system implements the "icmp_echo_ignore_broadcasts" variable with the following command: -- --# /sbin/sysctl -a | grep net.ipv4.icmp_echo_ignore_broadcasts --net.ipv4.icmp_echo_ignore_broadcasts = 1 -- --If the returned line does not have a value of "1", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040640The Oracle Linux operating system must prevent Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages from being accepted.<VulnDiscussion>ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to not accept IPv4 ICMP redirect messages by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.default.accept_redirects = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system will not accept IPv4 ICMP redirect messages. -- --# grep 'net.ipv4.conf.default.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/* -- --If "net.ipv4.conf.default.accept_redirects" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "0", this is a finding. -- --Check that the operating system implements the value of the "accept_redirects" variables with the following command: -- --# /sbin/sysctl -a | grep 'net.ipv4.conf.default.accept_redirects' --net.ipv4.conf.default.accept_redirects = 0 -- --If the returned line does not have a value of "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040641The Oracle Linux operating system must ignore Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirect messages.<VulnDiscussion>ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages modify the host's route table and are unauthenticated. An illicit ICMP redirect message could result in a man-in-the-middle attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to ignore IPv4 ICMP redirect messages by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.all.accept_redirects = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system ignores IPv4 ICMP redirect messages. -- --# grep 'net.ipv4.conf.all.accept_redirects' /etc/sysctl.conf /etc/sysctl.d/* -- --If "net.ipv4.conf.all.accept_redirects" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "0", this is a finding. -- --Check that the operating system implements the "accept_redirects" variables with the following command: -- --# /sbin/sysctl -a | grep 'net.ipv4.conf.all.accept_redirects' -- --net.ipv4.conf.all.accept_redirects = 0 -- --If the returned line does not have a value of "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040650The Oracle Linux operating system must not allow interfaces to perform Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects by default.<VulnDiscussion>ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the system not to allow interfaces to perform IPv4 ICMP redirects by default. -- --Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.default.send_redirects = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system does not allow interfaces to perform IPv4 ICMP redirects by default. -- --# grep 'net.ipv4.conf.default.send_redirects' /etc/sysctl.conf /etc/sysctl.d/* -- --If "net.ipv4.conf.default.send_redirects" is not configured in the "/etc/sysctl.conf" file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of "0", this is a finding. -- --Check that the operating system implements the "default send_redirects" variables with the following command: -- --# /sbin/sysctl -a | grep 'net.ipv4.conf.default.send_redirects' -- --net.ipv4.conf.default.send_redirects = 0 -- --If the returned line does not have a value of "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040660The Oracle Linux operating system must not send Internet Protocol version 4 (IPv4) Internet Control Message Protocol (ICMP) redirects.<VulnDiscussion>ICMP redirect messages are used by routers to inform hosts that a more direct route exists for a particular destination. These messages contain information from the system's route table, possibly revealing portions of the network topology.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the system not to allow interfaces to perform IPv4 ICMP redirects. -- --Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.conf.all.send_redirects = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system does not send IPv4 ICMP redirect messages. -- --# grep 'net.ipv4.conf.all.send_redirects' /etc/sysctl.conf /etc/sysctl.d/* -- --If "net.ipv4.conf.all.send_redirects" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of "0", this is a finding. -- --Check that the operating system implements the "all send_redirects" variables with the following command: -- --# /sbin/sysctl -a | grep 'net.ipv4.conf.all.send_redirects' -- --net.ipv4.conf.all.send_redirects = 0 -- --If the returned line does not have a value of "0", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040670Network interfaces configured on The Oracle Linux operating system must not be in promiscuous mode.<VulnDiscussion>Network interfaces in promiscuous mode allow for the capture of all network traffic visible to the system. If unauthorized individuals can access these applications, it may allow them to collect information such as logon IDs, passwords, and key exchanges between systems. -- --If the system is being used to perform a network troubleshooting function, the use of these tools must be documented with the Information System Security Officer (ISSO) and restricted to authorized personnel only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure network interfaces to turn off promiscuous mode unless approved by the ISSO and documented. -- --Set the promiscuous mode of an interface to off with the following command: -- --#ip link set dev <devicename> multicast off promisc offVerify network interfaces are not in promiscuous mode unless approved by the ISSO and documented. -- --Check for the status with the following command: -- --# ip link | grep -i promisc -- --If network interfaces are found on the system in promiscuous mode and their use has not been approved by the ISSO and documented, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040680The Oracle Linux operating system must be configured to prevent unrestricted mail relaying.<VulnDiscussion>If unrestricted mail relaying is permitted, unauthorized senders could use this host as a mail relay for the purpose of sending spam or other unauthorized activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366If "postfix" is installed, modify the "/etc/postfix/main.cf" file to restrict client connections to the local network with the following command: -- --# postconf -e 'smtpd_client_restrictions = permit_mynetworks,reject'Verify the system is configured to prevent unrestricted mail relaying. -- --Determine if "postfix" is installed with the following commands: -- --# yum list installed postfix --postfix-2.6.6-6.el7.x86_64.rpm -- --If postfix is not installed, this is Not Applicable. -- --If postfix is installed, determine if it is configured to reject connections from unknown or untrusted networks with the following command: -- --# postconf -n smtpd_client_restrictions --smtpd_client_restrictions = permit_mynetworks, reject -- --If the "smtpd_client_restrictions" parameter contains any entries other than "permit_mynetworks" and "reject", this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040690The Oracle Linux operating system must not have a File Transfer Protocol (FTP) server package installed unless needed.<VulnDiscussion>The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted file transfer methods must be used in place of this service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Document the "vsftpd" package with the ISSO as an operational requirement or remove it from the system with the following command: -- --# yum remove vsftpdVerify an FTP server has not been installed on the system. -- --Check to see if an FTP server has been installed with the following commands: -- --# yum list installed vsftpd -- --vsftpd-3.0.2.el7.x86_64.rpm -- --If "vsftpd" is installed and is not documented with the Information System Security Officer (ISSO) as an operational requirement, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040700The Oracle Linux operating system must not have the Trivial File Transfer Protocol (TFTP) server package installed if not required for operational support.<VulnDiscussion>If TFTP is required for operational support (such as the transmission of router configurations) its use must be documented with the Information System Security Officer (ISSO), restricted to only authorized personnel, and have access control rules established.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Remove the TFTP package from the system with the following command: -- --# yum remove tftp-serverVerify a TFTP server has not been installed on the system. -- --Check to see if a TFTP server has been installed with the following command: -- --# yum list installed tftp-server --tftp-server-0.49-9.el7.x86_64.rpm -- --If TFTP is installed and the requirement for TFTP is not documented with the ISSO, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040710The Oracle Linux operating system must be configured so that remote X connections for interactive users are encrypted.<VulnDiscussion>Open X displays allow an attacker to capture keystrokes and execute commands remotely.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure SSH to encrypt connections for interactive users. -- --Edit the "/etc/ssh/sshd_config" file to uncomment or add the line for the "X11Forwarding" keyword and set its value to "yes" (this file may be named differently or be in a different location if using a version of SSH that is provided by a third-party vendor): -- --X11Forwarding yes -- --The SSH service must be restarted for changes to take effect: -- --# systemctl restart sshdVerify remote X connections for interactive users are encrypted. -- --Check that remote X connections are encrypted with the following command: -- --# grep -i x11forwarding /etc/ssh/sshd_config | grep -v "^#" -- --X11Forwarding yes -- --If the "X11Forwarding" keyword is set to "no" or is missing, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040720The Oracle Linux operating system must be configured so that if the Trivial File Transfer Protocol (TFTP) server is required, the TFTP daemon is configured to operate in secure mode.<VulnDiscussion>Restricting TFTP to a specific directory prevents remote users from copying, transferring, or overwriting system files.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Configure the TFTP daemon to operate in secure mode by adding the following line to "/etc/xinetd.d/tftp" (or modify the line to have the required value): -- --server_args = -s /var/lib/tftpbootVerify the TFTP daemon is configured to operate in secure mode. -- --Check to see if a TFTP server has been installed with the following commands: -- --# yum list installed tftp-server --tftp-server.x86_64 x.x-x.el7 -- --If a TFTP server is not installed, this is Not Applicable. -- --If a TFTP server is installed, check for the server arguments with the following command: -- --# grep server_args /etc/xinetd.d/tftp --server_args = -s /var/lib/tftpboot -- --If the "server_args" line does not have a "-s" option and a subdirectory is not assigned, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040730The Oracle Linux operating system must not have an X Windows display manager installed unless approved.<VulnDiscussion>Internet services not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Document the requirement for an X Windows server with the ISSO or remove the related packages with the following commands: -- --# rpm -e xorg-x11-server-commonVerify that if the system has X Windows System installed, it is authorized. -- --Check for the X11 package with the following command: -- --# rpm -qa | grep xorg | grep server -- --Ask the System Administrator if use of the X Windows System is an operational requirement. -- --If the use of X Windows on the system is not documented with the Information System Security Officer (ISSO), this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040740The Oracle Linux operating system must not be performing packet forwarding unless the system is a router.<VulnDiscussion>Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this software is used when not required, system network information may be unnecessarily transmitted across the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to the required kernel parameter by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv4.ip_forward = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemVerify the system is not performing packet forwarding, unless the system is a router. -- --# grep net.ipv4.ip_forward /etc/sysctl.conf /etc/sysctl.d/* -- --net.ipv4.ip_forward = 0 -- --If "net.ipv4.ip_forward" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out, or does not have a value of "0", this is a finding. -- --Check that the operating system does not implement IP forwarding using the following command: -- --# /sbin/sysctl -a | grep net.ipv4.ip_forward --net.ipv4.ip_forward = 0 -- --If IP forwarding value is "1" and the system is hosting any application, database, or web servers, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040750The Oracle Linux operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.<VulnDiscussion>When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Update the "/etc/fstab" file so the option "sec" is defined for each NFS mounted file system and the "sec" option does not have the "sys" setting. -- --Ensure the "sec" option is defined as "krb5:krb5i:krb5p".Verify "AUTH_GSS" is being used to authenticate NFS mounts. -- --To check if the system is importing an NFS file system, look for any entries in the "/etc/fstab" file that have a file system type of "nfs" with the following command: -- --# cat /etc/fstab | grep nfs --192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p -- --If the system is mounting file systems via NFS and has the sec option without the "krb5:krb5i:krb5p" settings, the "sec" option has the "sys" setting, or the "sec" option is missing, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040800SNMP community strings on the Oracle Linux operating system must be changed from the default.<VulnDiscussion>Whether active or not, default Simple Network Management Protocol (SNMP) community strings must be changed to maintain security. If the service is running with the default authenticators, anyone can gather data about the system and the network and use the information to potentially compromise the integrity of the system or network(s). It is highly recommended that SNMP version 3 user authentication and message encryption be used in place of the version 2 community strings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366If the "/etc/snmp/snmpd.conf" file exists, modify any lines that contain a community string value of "public" or "private" to another string value.Verify that a system using SNMP is not using default community strings. -- --Check to see if the "/etc/snmp/snmpd.conf" file exists with the following command: -- --# ls -al /etc/snmp/snmpd.conf ---rw------- 1 root root 52640 Mar 12 11:08 snmpd.conf -- --If the file does not exist, this is Not Applicable. -- --If the file does exist, check for the default community strings with the following commands: -- --# grep public /etc/snmp/snmpd.conf --# grep private /etc/snmp/snmpd.conf -- --If either of these commands returns any output, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040810The Oracle Linux operating system access control program must be configured to grant or deny system access to specific hosts and services.<VulnDiscussion>If the systems access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366If "firewalld" is installed and active on the system, configure rules for allowing specific services and hosts. -- --If "firewalld" is not "active", enable "tcpwrappers" by configuring "/etc/hosts.allow" and "/etc/hosts.deny" to allow or deny access to specific hosts.If the "firewalld" package is not installed, ask the System Administrator (SA) if another firewall application (such as iptables) is installed. If an application firewall is not installed, this is a finding. -- --Verify the system's access control program is configured to grant or deny system access to specific hosts. -- --Check to see if "firewalld" is active with the following command: -- --# systemctl status firewalld --firewalld.service - firewalld - dynamic firewall daemon --Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled) --Active: active (running) since Sun 2014-04-20 14:06:46 BST; 30s ago -- --If "firewalld" is active, check to see if it is configured to grant or deny access to specific hosts or services with the following commands: -- --# firewall-cmd --get-default-zone --public -- --# firewall-cmd --list-all --zone=public --public (active) --target: default --icmp-block-inversion: no --interfaces: eth0 --sources: --services: mdns ssh --ports: --protocols: --masquerade: no --forward-ports: --icmp-blocks: -- --If "firewalld" is not active, determine whether "tcpwrappers" is being used by checking whether the "hosts.allow" and "hosts.deny" files are empty with the following commands: -- --# ls -al /etc/hosts.allow --rw-r----- 1 root root 9 Aug 2 23:13 /etc/hosts.allow -- --# ls -al /etc/hosts.deny ---rw-r----- 1 root root 9 Apr 9 2007 /etc/hosts.deny -- --If "firewalld" and "tcpwrappers" are not installed, configured, and active, ask the SA if another access control program (such as iptables) is installed and active. Ask the SA to show that the running configuration grants or denies access to specific hosts or services. -- --If "firewalld" is active and is not configured to grant access to specific hosts or "tcpwrappers" is not configured to grant or deny access to specific hosts, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040820The Oracle Linux operating system must not have unauthorized IP tunnels configured.<VulnDiscussion>IP tunneling mechanisms can be used to bypass network filtering. If tunneling is required, it must be documented with the Information System Security Officer (ISSO).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Remove all unapproved tunnels from the system, or document them with the ISSO.Verify the system does not have unauthorized IP tunnels configured. -- --Check to see if "libreswan" is installed with the following command: -- --# yum list installed libreswan --libreswan.x86-64 3.20-5.el7_4 -- --If "libreswan" is installed, check to see if the "IPsec" service is active with the following command: -- --# systemctl status ipsec --ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec --Loaded: loaded (/usr/lib/systemd/system/ipsec.service; disabled) --Active: inactive (dead) -- --If the "IPsec" service is active, check to see if any tunnels are configured in "/etc/ipsec.conf" and "/etc/ipsec.d/" with the following commands: -- --# grep -iw conn /etc/ipsec.conf /etc/ipsec.d/*.conf -- --If there are indications that a "conn" parameter is configured for a tunnel, ask the System Administrator if the tunnel is documented with the ISSO. -- --If "libreswan" is installed, "IPsec" is active, and an undocumented tunnel is active, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-040830The Oracle Linux operating system must not forward IPv6 source-routed packets.<VulnDiscussion>Source-routed packets allow the source of the packet to suggest that routers forward the packet along a different path than configured on the router, which can be used to bypass network security measures. This requirement applies only to the forwarding of source-routed traffic, such as when IPv6 forwarding is enabled and the system is functioning as a router.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Set the system to the required kernel parameter, if IPv6 is enabled, by adding the following line to "/etc/sysctl.conf" or a configuration file in the /etc/sysctl.d/ directory (or modify the line to have the required value): -- --net.ipv6.conf.all.accept_source_route = 0 -- --Issue the following command to make the changes take effect: -- --# sysctl --systemIf IPv6 is not enabled, the key will not exist, and this is Not Applicable. -- --Verify the system does not accept IPv6 source-routed packets. -- --# grep net.ipv6.conf.all.accept_source_route /etc/sysctl.conf /etc/sysctl.d/* -- --net.ipv6.conf.all.accept_source_route = 0 -- --If "net.ipv6.conf.all.accept_source_route" is not configured in the /etc/sysctl.conf file or in the /etc/sysctl.d/ directory, is commented out or does not have a value of "0", this is a finding. -- --Check that the operating system implements the accept source route variable with the following command: -- --# /sbin/sysctl -a | grep net.ipv6.conf.all.accept_source_route --net.ipv6.conf.all.accept_source_route = 0 -- --If the returned lines do not have a value of "0", this is a finding.SRG-OS-000105-GPOS-00052<GroupDescription></GroupDescription>OL07-00-041001The Oracle Linux operating system must have the required packages for multifactor authentication installed.<VulnDiscussion>Using an authentication device, such as a CAC or token separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. -- --Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators, and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. -- --A privileged account is defined as an information system account with authorizations of a privileged user. -- --Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. -- --This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). -- --Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000765CCI-001948CCI-001953Configure the operating system to implement multifactor authentication by installing the required packages. -- --Install the "esc" and "pam_pkcs11" packages on the system with the following command: -- --# yum install esc pam_pkcs11Verify the operating system has the packages required for multifactor authentication installed. -- --Check for the presence of the packages required to support multifactor authentication with the following commands: -- --# yum list installed esc --esc-1.1.0-26.el7.noarch.rpm -- --# yum list installed pam_pkcs11 --pam_pkcs11-0.6.2-14.el7.noarch.rpm -- -- --If the "esc" and "pam_pkcs11" packages are not installed, this is a finding.SRG-OS-000375-GPOS-00160<GroupDescription></GroupDescription>OL07-00-041002The Oracle Linux operating system must implement multifactor authentication for access to privileged accounts via pluggable authentication modules (PAM).<VulnDiscussion>Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. -- --Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. -- --A privileged account is defined as an information system account with authorizations of a privileged user. -- --Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. -- --This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). -- --Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001948CCI-001953CCI-001954Configure the operating system to implement multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM). -- --Modify all of the services lines in "/etc/sssd/sssd.conf" or in configuration files found under "/etc/sssd/conf.d" to include pam.Verify the operating system implements multifactor authentication for remote access to privileged accounts via pluggable authentication modules (PAM). -- --Check the "/etc/sssd/sssd.conf" file for the authentication services that are being used with the following command: -- --# grep services /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf -- --services = nss, pam -- --If the "pam" service is not present on all "services" lines, this is a finding.SRG-OS-000375-GPOS-00160<GroupDescription></GroupDescription>OL07-00-041003The Oracle Linux operating system must implement certificate status checking for PKI authentication.<VulnDiscussion>Using an authentication device, such as a CAC or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device. -- --Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card. -- --A privileged account is defined as an information system account with authorizations of a privileged user. -- --Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. -- --This requirement only applies to components where this is specific to the function of the device or has the concept of an organizational user (e.g., VPN, proxy capability). This does not apply to authentication for the purpose of configuring the device itself (management). -- --Satisfies: SRG-OS-000375-GPOS-00160, SRG-OS-000375-GPOS-00161, SRG-OS-000377-GPOS-00162</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-001948CCI-001953CCI-001954Configure the operating system to do certificate status checking for PKI authentication. -- --Modify all of the "cert_policy" lines in "/etc/pam_pkcs11/pam_pkcs11.conf" to include "ocsp_on".Verify the operating system implements certificate status checking for PKI authentication. -- --Check to see if Online Certificate Status Protocol (OCSP) is enabled on the system with the following command: -- --# grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf | grep -v "^#" -- --cert_policy = ca, ocsp_on, signature; --cert_policy = ca, ocsp_on, signature; --cert_policy = ca, ocsp_on, signature; -- --There should be at least three lines returned. -- --If "ocsp_on" is not present in all uncommented "cert_policy" lines in "/etc/pam_pkcs11/pam_pkcs11.conf", this is a finding.SRG-OS-000424-GPOS-00188<GroupDescription></GroupDescription>OL07-00-041010The Oracle Linux operating system must be configured so that all wireless network adapters are disabled.<VulnDiscussion>The use of wireless networking can introduce many different attack vectors into the organization's network. Common attack vectors such as malicious association and ad hoc networks will allow an attacker to spoof a wireless access point (AP), allowing validated systems to connect to the malicious AP, and enabling the attacker to monitor and record network traffic. These malicious APs can also serve to create a man-in-the-middle attack, or be used to create a denial of service to valid network resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002421Configure the system to disable all wireless network interfaces with the following command: -- --#nmcli radio wifi offVerify that there are no wireless interfaces configured on the system. -- --This is N/A for systems that do not have wireless network adapters. -- --Check for the presence of active wireless interfaces with the following command: -- --# nmcli device --DEVICE TYPE STATE --eth0 ethernet connected --wlp3s0 wifi disconnected --lo loopback unmanaged -- --If a wireless interface is configured and its use on the system is not documented with the Information System Security Officer (ISSO), this is a finding.SRG-OS-000057-GPOS-00027<GroupDescription></GroupDescription>OL07-00-910055The Oracle Linux operating system must protect audit information from unauthorized read, modification, or deletion.<VulnDiscussion>If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. -- --To ensure the veracity of audit information, the operating system must protect audit information from unauthorized modification. -- --Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity. -- --Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000162CCI-000163CCI-000164CCI-001314Change the mode of the audit log files with the following command: -- --# chmod 0600 [audit_file] -- --Change the owner and group owner of the audit log files with the following command: -- --# chown root:root [audit_file]Verify the operating system audit records have proper permissions and ownership. -- --List the full permissions and ownership of the audit log files with the following command. -- --# ls -la /var/log/audit --total 4512 --drwx------. 2 root root 23 Apr 25 16:53 . --drwxr-xr-x. 17 root root 4096 Aug 9 13:09 .. ---rw-------. 1 root root 8675309 Aug 9 12:54 audit.log -- --Audit logs must be mode 0600 or less permissive. --If any are more permissive, this is a finding. -- --The owner and group owner of all audit log files must both be "root". If any other owner or group owner is listed, this is a finding.SRG-OS-000445-GPOS-00199<GroupDescription></GroupDescription>OL07-00-020210The Oracle Linux operating system must enable SELinux.<VulnDiscussion>Without verification of the security functions, security functions may not operate correctly and the failure may go unnoticed. Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. -- --This requirement applies to operating systems performing security function verification/testing and/or systems and environments that require this functionality.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-002696Configure the operating system to verify correct operation of all security functions. -- --Set the "SELinux" status and the "Enforcing" mode by modifying the "/etc/selinux/config" file to have the following line: -- --SELINUX=enforcing -- --A reboot is required for the changes to take effect.If an HBSS or HIPS is active on the system, this is Not Applicable. -- --Verify the operating system verifies correct operation of all security functions. -- --Check if "SELinux" is active and in "Enforcing" mode with the following command: -- --# getenforce --Enforcing -- --If "SELinux" is not active and not in "Enforcing" mode, this is a finding.SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>OL07-00-010219The Oracle Linux operating system must be integrated into a directory service infrastructure.<VulnDiscussion>Enterprise environments make account management challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other errors. -- --A comprehensive account management process that includes automation helps to ensure accounts designated as requiring attention are addressed consistently and promptly. Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated. This requirement applies to all account types, including individual/user, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. Automated mechanisms may be composed of differing technologies that, when placed together, contain an overall automated mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Linux 7DISADPMS TargetOracle Linux 72881CCI-000366Connect the operating system to a directory service infrastructure.Verify that the operating system has been integrated into a directory service infrastructure. -- --With the assistance of the system administrator, validate that the operating system is using a directory services infrastructure for account management operations. -- --If the operating system is not connected to a directory services infrastructure, this is a finding. -\ No newline at end of file -diff --git a/shared/references/disa-stig-ol7-v2r1-xccdf-manual.xml b/shared/references/disa-stig-ol7-v2r1-xccdf-manual.xml -new file mode 100644 -index 0000000000..337f1520e5 ---- /dev/null -+++ b/shared/references/disa-stig-ol7-v2r1-xccdf-manual.xml -@@ -0,0 +1,5072 @@ -+acceptedOracle Linux 7 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 1 Benchmark Date: 23 Oct 20203.1.1.362251.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-OS-000257-GPOS-00098<GroupDescription></GroupDescription>RHEL-07-010010The Red Hat Enterprise Linux operating system must be configured so that the file permissions, ownership, and group membership of system files and commands match the vendor values.<VulnDiscussion>Discretionary access control is weakened if a user or group has access permissions to system files and directories greater than the default. ++acceptedRed Hat Enterprise Linux 7 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 4 Benchmark Date: 23 Jul 20213.2.2.360791.10.03I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-OS-000480-GPOS-00227<GroupDescription></GroupDescription>RHEL-08-010000RHEL 8 must be a vendor-supported release.<VulnDiscussion>An operating system release is considered "supported" if the vendor continues to provide security patches for the product. With an unsupported release, it will not be possible to resolve security issues discovered in the system software. ++acceptedRed Hat Enterprise Linux 8 Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 3 Benchmark Date: 23 Jul 20213.2.2.360791.10.01I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>SRG-APP-000516<GroupDescription></GroupDescription>DTBF003Installed version of Firefox unsupported.<VulnDiscussion>Use of versions of an application which are not supported by the vendor are not permitted. Vendors respond to security flaws with updates and patches. These updates are not available for unsupported version which can leave the application vulnerable to attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-19509V-17988CCI-000366Upgrade the version of the browser to an approved version by obtaining software from the vendor or other trusted source.Method 1: View the following registry key: ++HKLM\Software\Mozilla\Mozilla Firefox\CurrentVersion ++ ++Method 2: Run Firefox. Click the ellipsis button >> Help >> About Firefox, and view the version number. ++ ++Criteria: If the Firefox version is not a supported version, this is a finding.SRG-APP-000560<GroupDescription></GroupDescription>DTBF030Firefox must be configured to allow only TLS.<VulnDiscussion>Use of versions prior to TLS 1.1 are not permitted. SSL 2.0 and SSL 3.0 contain a number of security flaws. These versions must be disabled in compliance with the Network Infrastructure and Secure Remote Computing STIGs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16925V-15983CCI-001453Configure the following parameters using the Mozilla.cfg file: ++ ++LockPref "security.tls.version.min" is set to "2". ++LockPref "security.tls.version.max" is set to "4".Open a browser window, type "about:config" in the address bar. ++ ++Verify Preference Name "security.tls.version.min" is set to the value "2" and locked. ++Verify Preference Name "security.tls.version.max" is set to the value "4" and locked. ++ ++Criteria: If the parameters are set incorrectly, this is a finding. ++ ++If the settings are not locked, this is a finding.SRG-APP-000177<GroupDescription></GroupDescription>DTBF050FireFox is configured to ask which certificate to present to a web site when a certificate is required.<VulnDiscussion>When a web site asks for a certificate for user authentication, Firefox must be configured to have the user choose which certificate to present. Websites within DOD require user authentication for access which increases security for DoD information. Access will be denied to the user if certificate management is not configured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16707V-15768CCI-000187Set the value of "security.default_personal_cert" to "Ask Every Time". Use the Mozilla.cfg file to lock the preference so users cannot change it. ++ ++Type "about:config" in the browser address bar. Verify Preference Name "security.default_personal_cert" is set to "Ask Every Time" and is locked to prevent the user from altering. ++ ++Criteria: If the value of "security.default_personal_cert" is set incorrectly or is not locked, then this is a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF085Firefox automatically checks for updated version of installed Search plugins.<VulnDiscussion>Updates need to be controlled and installed from authorized and trusted servers. This setting overrides a number of other settings which may direct the application to access external URLs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-21890V-19744CCI-000381Ensure the preference "browser.search.update" is set and locked to the value of “False”.Type "about:config" in the browser window. Verify the preference "browser.search.update” is set to "false" and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF090Firefox automatically updates installed add-ons and plugins.<VulnDiscussion>Set this to false to disable checking for updated versions of the Extensions/Themes. Automatic updates from untrusted sites puts the enclave at risk of attack and may override security settings.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-59603V-19742CCI-000381Set the preference “extensions.update.enabled” value to "false" and lock using the Mozilla.cfg file. ++Type "about:config" in the browser window. Verify the preference “extensions.update.enabled” is set to "false" and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If this setting is not locked, then this is a finding. ++SRG-APP-000278<GroupDescription></GroupDescription>DTBF100Firefox automatically executes or downloads MIME types which are not authorized for auto-download.<VulnDiscussion>The default action for file types for which a plugin is installed is to automatically download and execute the file using the associated plugin. Firefox allows you to change the specified download action so that the file is opened with a selected external application or saved to disk instead. View the list of installed browser plugins and related MIME types by entering about:plugins in the address bar. ++ ++When you click a link to download a file, the MIME type determines what action Firefox will take. You may already have a plugin installed that will automatically handle the download, such as Windows Media Player or QuickTime. Other times, you may see a dialog asking whether you want to save the file or open it with a specific application. When you tell Firefox to open or save the file and also check the option to "Do this automatically for files like this from now on", an entry appears for that type of file in the Firefox Applications panel, shown below.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16709V-15770CCI-001242Remove any unauthorized extensions from the autodownload list. Use Method 1 or 2 to check if the following extensions are listed in the browser configuration: HTA, JSE, JS, MOCHA, SHS, VBE, VBS, SCT, WSC. By default, most of these extensions will not show up on the Firefox listing. ++ ++Criteria: ++ ++Method 1: In about:plugins, Installed plug-in, inspect the entries in the Suffixes column. ++ ++If any of the prohibited extensions are found, then for each of them, verify that it is not associated with an application that executes code. However, applications such as Notepad.exe that do not execute code may be associated with the extension. If the extension is associated with an unauthorized application, then this is a finding. ++ ++If the extension exists but is not associated with an application, then this is a finding. ++ ++Method 2: ++Use the Options User Interface Applications menu to search for the prohibited extensions in the Content column of the table. ++ ++If an extension that is not approved for automatic execution exists and the entry in the Action column is associated with an application that does not execute the code (e.g., Notepad), then do not mark this as a finding. ++ ++If the entry exists and the "Action" is 'Save File' or 'Always Ask', then this is not a finding. ++ ++If an extension exists and the entry in the Action column is associated with an application that does/can execute the code, then this is a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF105Network shell protocol is enabled in FireFox.<VulnDiscussion>Although current versions of Firefox have this set to disabled by default, use of this option can be harmful. This would allow the browser to access the Windows shell. This could allow access to the ++underlying system. This check verifies that the default setting has not been changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16710V-15771CCI-000381Procedure: Set the value of "network.protocol-handler.external.shell" to "false" and lock using the Mozilla.cfg file.Procedure: Open a browser window, type "about:config" in the address bar. ++ ++Criteria: If the value of "network.protocol-handler.external.shell" is not "false" or is not locked, then this is a finding. SRG-APP-000279<GroupDescription></GroupDescription>DTBF110Firefox is not configured to prompt a user before downloading and opening required file types.<VulnDiscussion>New file types cannot be added directly to the helper applications or plugins listing. Files with these extensions will not be allowed to use Firefox publicly available plugins and extensions to open. The application will be configured to open these files using external applications only. After a helper application or save to disk download action has been set, that action will be taken automatically for those types of files. When the user receives a dialog box asking if you want to save the file or open it with a specified application, this indicates that a plugin does not exist. The user has not previously selected a download action or helper application to automatically use for that type of file. When prompted, if the user checks the option to Do this automatically for files like this from now on, then an entry will appear for that type of file in the plugins listing and this file type is automatically opened in the future. This can be a security issue. New file types cannot be added directly to the Application plugin listing. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16711V-15772CCI-001243Ensure the following extensions are not automatically opened by Firefox without user confirmation. Do not use plugins and add-ons to open these files. ++Use the "plugin.disable_full_page_plugin_for_types" preference to set and lock the following extensions so that an external application, rather than an add-on or plugin, will not be used: ++PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, WKS, BAT, PS, EPS, WCH, WCM, WB1, WB3, RTF, DOC, MDB, MDE, WBK, WB1, WCH, WCM, AD, ADP.Open a browser window, type "about:config" in the address bar. ++Criteria: If the “plugin.disable_full_page_plugin_for_types” value is not set to include the following external extensions and not locked, this is a finding: ++PDF, FDF, XFDF, LSL, LSO, LSS, IQY, RQY, XLK, XLS, XLT, POT, PPS, PPT, DOS, DOT, WKS, BAT, PS, EPS, WCH, WCM, WB1, WB3, RTF, DOC, MDB, MDE, WBK, WB1, WCH, WCM, AD, ADP.SRG-APP-000210<GroupDescription></GroupDescription>DTBF120FireFox plug-in for ActiveX controls is installed.<VulnDiscussion>When an ActiveX control is referenced in an HTML document, MS Windows checks to see if ++the control already resides on the client machine. If not, the control can be downloaded from a ++remote web site. This provides an automated delivery method for mobile code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16712V-15773CCI-001170Remove/uninstall the Mozilla ActiveX plugin Open a browser window, type "about:plugins" in the address bar. ++ ++Criteria: If the Mozilla ActiveX control and plugin support is present and enabled, then this is a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF140Firefox formfill assistance option is disabled.<VulnDiscussion>In order to protect privacy and sensitive data, Firefox provides the ability to configure Firefox such that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16713V-15774CCI-000381Ensure the preference “browser.formfill.enable" is set and locked to the value of “false”.Type "about:config" in the address bar, verify that the preference name “browser.formfill.enable" is set to “false” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF150Firefox is configured to autofill passwords.<VulnDiscussion>While on the internet, it may be possible for an attacker to view the saved password files and gain access to the user's accounts on various hosts. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16714V-15775CCI-000381Ensure the preference "signon.autofillForms" is set and locked to the value of “false”.In About:Config, verify that the preference name “signon.autofillForms“ is set to “false” and locked. ++Criteria: If the parameter is set incorrectly, this is a finding. ++If the setting is not locked, this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF160FireFox is configured to use a password store with or without a master password.<VulnDiscussion>Firefox can be set to store passwords for sites visited by the user. These individual passwords are stored in a file and can be protected by a master password. Autofill of the password can then be enabled when the site is visited. This feature could also be used to autofill the certificate pin which could lead to compromise of DoD information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16715V-15776CCI-000381Ensure the preference “signon.rememberSignons“ is set and locked to the value of “false”.Type "about:config" in the browser window. Verify that the preference name “signon.rememberSignons" is set and locked to “false”. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. ++ ++If the setting is not locked, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF180FireFox is not configured to block pop-up windows.<VulnDiscussion>Popup windows may be used to launch an attack within a new browser window with altered settings. This setting blocks popup windows created while the page is loading.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16717V-15778CCI-000381Ensure the preference "dom.disable_window_open_feature.status " is set and locked to the value of “true”.In About:Config, verify that the preference name “dom.disable_window_open_feature.status " is set to “true” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF181FireFox is configured to allow JavaScript to move or resize windows. ++<VulnDiscussion>JavaScript can make changes to the browser’s appearance. This activity can help disguise an attack taking place in a minimized background window. Set browser setting to prevent scripts on visited websites from moving and resizing browser windows. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16718V-15779CCI-000381Ensure the preference "dom.disable_window_move_resize" is set and locked to the value of “true”.In About:Config, verify that the preference name “dom.disable_window_move_resize" is set and locked to “true”. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF182Firefox is configured to allow JavaScript to raise or lower windows.<VulnDiscussion>JavaScript can make changes to the browser’s appearance. Allowing a website to use JavaScript to raise and lower browser windows may disguise an attack. Browser windows may not be set as active via JavaScript.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16927V-15985CCI-000381Ensure the preference "dom.disable_window_flip" is set and locked to the value of “true”.In About:Config, verify that the preference name “dom.disable_window_flip" is set and locked to “true”. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF183Firefox is configured to allow JavaScript to disable or replace context menus.<VulnDiscussion>A context menu (also known as a pop-up menu) is often used in a graphical user interface (GUI) and appears upon user interaction (e.g., a right mouse click). A context menu offers a limited set of choices that are available in the current state, or context, of the operating system or application. A website may execute JavaScript that can make changes to these context menus. This can help disguise an attack. Set this preference to "false" so that webpages will not be able to affect the context menu event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-16928V-15986CCI-000381Ensure the preferences "dom.event.contextmenu.enabled" is set and locked to "false".Type "about:config" in the address bar of the browser. ++ ++Verify that the preferences "dom.event.contextmenu.enabled" is set and locked to "false". ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. ++ ++If the setting is not locked, this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF186Extensions install must be disabled.<VulnDiscussion>A browser extension is a program that has been installed into the browser which adds functionality to it. Where a plug-in interacts only with a web page and usually a third party external application (Flash, Adobe Reader) an extension interacts with the browser program itself. Extensions are not embedded in web pages and must be downloaded and installed in order to work. Extensions allow browsers to avoid restrictions which apply to web pages. For example, an extension can be written to combine data from multiple domains and present it when a certain page is accessed which can be considered Cross Site Scripting. If a browser is configured to allow unrestricted use of extension then plug-ins can be loaded and installed from malicious sources and used on the browser.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-79381V-64891CCI-000381Set the preference “xpinstall.enabled” to “false” and lock using the “mozilla.cfg” file. The “mozilla.cfg” file may need to be created if it does not already exist.Open a browser window, type "about:config" in the address bar, then navigate to the setting for Preference Name "xpinstall.enabled" and set the value to “false” and locked. ++ ++Criteria: If the value of “xpinstall.enabled” is “false”, this is not a finding. ++ ++If the value is locked, this is not a finding. ++SRG-APP-000141<GroupDescription></GroupDescription>DTBF190Background submission of information to Mozilla must be disabled.<VulnDiscussion>There should be no background submission of technical and other information from DoD computers to Mozilla with portions posted publically.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-93759V-79053CCI-000381Ensure the preferences "datareporting.policy.dataSubmissionEnabled" is set and locked to "false".Type "about:config" in the address bar of the browser. ++Verify that the preference "datareporting.policy.dataSubmissionEnabled" is set and locked to "false". Otherwise, this is a finding.SRG-APP-000266<GroupDescription></GroupDescription>DTBF195Firefox Development Tools Must Be Disabled.<VulnDiscussion>While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application related data via the browser. Page elements, source code, javascript, API calls, application data, etc. may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-106633V-97529CCI-001312Set the value of "devtools.policy.disabled" to "true" using the Mozilla.cfg file, or the registry value of HKLM\Software\Policies\Mozilla\Firefox\DisableDeveloperTools to “1”Procedure: Open a browser window, type "about:config" in the address bar. ++ ++Criteria: If the value of "devtools.policy.disabled" is not "true", then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF200Telemetry must be disabled.<VulnDiscussion>The Telemetry feature provides this capability by sending performance and usage info to Mozilla. As you use Firefox, Telemetry measures and collects non-personal information, such as performance, hardware, usage and customizations. It then sends this information to Mozilla on a daily basis and we use it to improve Firefox.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-111837V-102875CCI-000381Ensure the preference “toolkit.telemetry.enabled" is set and locked to the value of “false”.Type "about:config" in the address bar, verify that the preference name “toolkit.telemetry.enabled" is set to “false” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF205Telemetry archive must be disabled.<VulnDiscussion>The Telemetry feature provides this capability by sending performance and usage info to Mozilla. As you use Firefox, Telemetry measures and collects non-personal information, such as performance, hardware, usage and customizations. It then sends this information to Mozilla on a daily basis and we use it to improve Firefox.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-111839V-102877CCI-000381Ensure the preference “toolkit.telemetry.archive.enabled" is set and locked to the value of “false”.Type "about:config" in the address bar, verify that the preference name “toolkit.telemetry.archive.enabled" is set to “false” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF210Fingerprinting protection must be enabled.<VulnDiscussion>The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists you set Firefox to use, then the fingerprinting script (or other tracking script/image) will not be loaded from that site. ++ ++Fingerprinting scripts collect information about your browser and device configuration, such as your operating system, screen resolution, and other settings. By compiling these pieces of data, fingerprinters create a unique profile of you that can be used to track you around the Web.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-111841V-102879CCI-000381Ensure the preference “privacy.trackingprotection.fingerprinting.enabled" is set and locked to the value of “true”.Type "about:config" in the address bar, verify that the preference name “privacy.trackingprotection.fingerprinting.enabled" is set to “true” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF215Cryptomining protection must be enabled.<VulnDiscussion>The Content Blocking/Tracking Protection feature stops Firefox from loading content from malicious sites. The content might be a script or an image, for example. If a site is on one of the tracker lists you set Firefox to use, then the fingerprinting script (or other tracking script/image) will not be loaded from that site. ++ ++Cryptomining scripts use your computer’s central processing unit (CPU) to invisibly mine cryptocurrency.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-111843V-102881CCI-000381Ensure the preference “privacy.trackingprotection.cryptomining.enabled" is set and locked to the value of “true”.Type "about:config" in the address bar, verify that the preference name “privacy.trackingprotection.cryptomining.enabled" is set to “true” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF220Enhanced Tracking Protection must be enabled.<VulnDiscussion>Tracking generally refers to content, cookies, or scripts that can collect your browsing data across multiple sites.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-111845V-102883CCI-000381Ensure the preference “browser.contentblocking.category" is set and locked to the value of “strict”.Type "about:config" in the address bar, verify that the preference name “browser.contentblocking.category" is set to “strict” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000141<GroupDescription></GroupDescription>DTBF225Extension recommendations must be disabled.<VulnDiscussion>The Recommended Extensions program will make it easier for users to discover extensions that have been reviewed for security, functionality, and user experience.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-111847V-102885CCI-000381Ensure the preference “extensions.htmlaboutaddons.recommendations.enabled" is set and locked to the value of “false”.Type "about:config" in the address bar, verify that the preference name “extensions.htmlaboutaddons.recommendations.enabled" is set to “false” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000560<GroupDescription></GroupDescription>DTBF235Deprecated ciphers must be disabled.<VulnDiscussion>A weak cipher is defined as an encryption/decryption algorithm that uses a key of insufficient length. Using an insufficient length for a key in an encryption/decryption algorithm opens up the possibility (or probability) that the encryption scheme could be broken.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097SV-111851V-102889CCI-001453Ensure the preference “security.ssl3.rsa_des_ede3_sha" is set and locked to the value of “false”.Type "about:config" in the address bar, verify that the preference name “security.ssl3.rsa_des_ede3_sha" is set to “false” and locked. ++ ++Criteria: If the parameter is set incorrectly, then this is a finding. If the setting is not locked, then this is a finding.SRG-APP-000175<GroupDescription></GroupDescription>DTBG010The DOD Root Certificate is not installed.<VulnDiscussion>The DOD root certificate will ensure that the trust chain is established for server certificate issued from the DOD CA.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Mozilla FirefoxDISADPMS TargetMozilla Firefox4097V-6318SV-33373CCI-000185Install the DOD root certificates.Navigate to Tools >> Options >> Advanced >> Certificates tab >> View Certificates button. On the Certificate Manager window, select the "Authorities" tab. Scroll through the Certificate Name list to the U.S. Government heading. Look for the entries for DoD Root CA 2, DoD Root CA 3, and DoD Root CA 4. ++ ++If there are entries for DoD Root CA 2, DoD Root CA 3, and DoD Root CA 4, select them individually. ++ ++Click the "View" button. ++ ++Verify the publishing organization is "US Government." ++ ++If there are no entries for the DoD Root CA 2, DoD Root CA 3, and DoD Root CA 4, this is a finding. ++ ++Note: In a Windows environment, use of policy setting "security.enterprise_roots.enabled=true" will point Firefox to the Windows Trusted Root Certification Authority Store, this is not a finding. +\ No newline at end of file + +From 7288ed4aa434af8214a6fef5e6f7f17487773ccc Mon Sep 17 00:00:00 2001 +From: Gabriel Becker +Date: Mon, 26 Jul 2021 18:09:20 +0200 +Subject: [PATCH 07/10] Update DISA STIG JRE manual benchmark file. + +--- + .../disa-stig-jre8-unix-v1r3-xccdf-manual.xml | 270 ----------------- + .../disa-stig-jre8-unix-v2r1-xccdf-manual.xml | 272 ++++++++++++++++++ + 2 files changed, 272 insertions(+), 270 deletions(-) + delete mode 100644 shared/references/disa-stig-jre8-unix-v1r3-xccdf-manual.xml + create mode 100644 shared/references/disa-stig-jre8-unix-v2r1-xccdf-manual.xml + +diff --git a/shared/references/disa-stig-jre8-unix-v1r3-xccdf-manual.xml b/shared/references/disa-stig-jre8-unix-v1r3-xccdf-manual.xml +deleted file mode 100644 +index 0e2deaaa779..00000000000 +--- a/shared/references/disa-stig-jre8-unix-v1r3-xccdf-manual.xml ++++ /dev/null +@@ -1,270 +0,0 @@ +-acceptedJava Runtime Environment (JRE) version 8 STIG for UnixThe Java Runtime Environment (JRE) is a bundle developed and offered by Oracle Corporation which includes the Java Virtual Machine (JVM), class libraries, and other components necessary to run Java applications and applets. Certain default settings within the JRE pose a security risk so it is necessary to deploy system wide properties to ensure a higher degree of security when utilizing the JRE.DISASTIG.DOD.MILRelease: 3 Benchmark Date: 27 Oct 20171I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000516<GroupDescription></GroupDescription>JRE8-UX-000010Oracle JRE 8 must have a deployment.config file present.<VulnDiscussion>By default no deployment.config file exists; thus, no system-wide deployment.properties file exists. The file must be created. The deployment.config file is used for specifying the location and execution of system-level properties for the Java Runtime Environment. Without the deployment.config file, setting particular options for the Java control panel is impossible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-000366Create a JRE deployment configuration file as indicated: +- +-/etc/.java/deployment/deployment.configVerify a JRE deployment configuration file exists as indicated: +- +-/etc/.java/deployment/deployment.config +- +-If the configuration file does not exist as indicated, this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-UX-000020Oracle JRE 8 deployment.config file must contain proper keys and values.<VulnDiscussion>The deployment.config configuration file contains two keys. +- +-The "deployment.properties" key includes the path of the "deployment.properties" file and the "deployment.properties.mandatory" key contains either a TRUE or FALSE value. +- +-If the path specified to "deployment.properties" does not lead to a "deployment.properties" file, the value of the “deployment.system.config.mandatory” key determines how JRE will handle the situation. +- +-If the value of the "deployment.system.config.mandatory" key is TRUE and if the path to the "deployment.properties" file is invalid, the JRE will not allow Java applications to run. This is the desired behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-000366Navigate to the “deployment.config” file for JRE: +- +-/etc/.java/deployment/deployment.config +- +-Add the key “deployment.system.config=<Path to deployment.properties>” to the deployment.config file. The following is an example: +-“deployment.system.config=/etc/.java/deployment/deployment.properties". Note the use of forward slashes. +- +-Add the key “deployment.system.config.mandatory=true” to the deployment.config file.Navigate to the “deployment.config” file for JRE: +- +-/etc/.java/deployment/deployment.config +- +-The deployment.config file contains two properties: deployment.system.config and deployment.system.config.mandatory. +- +-The "deployment.system.config" key points to the location of the deployment.properties file. The location is variable. It can point to a file on the local disk, or a UNC path. The following is an example: +-“deployment.system.config=/etc/.java/deployment/deployment.properties" +- +-If the “deployment.system.config” key does not exist or does not point to the location of the deployment.properties file, this is a finding. +- +-If the “deployment.system.config.mandatory” key does not exist or is set to false, this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-UX-000030Oracle JRE 8 must have a deployment.properties file present.<VulnDiscussion>By default no deployment.properties file exists; thus, no system-wide deployment exists. The file must be created. The deployment.properties file is used for specifying keys for the Java Runtime Environment. Each option in the Java control panel is represented by property keys. These keys adjust the options in the Java control panel based on the value assigned to that key. Without the deployment.properties file, setting particular options for the Java control panel is impossible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-000366Create the Java deployment properties file “/etc/.java/deployment/deployment.properties”Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If there is no file entitled “deployment.properties”, this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-UX-000060Oracle JRE 8 must default to the most secure built-in setting.<VulnDiscussion>Applications that are signed with a valid certificate and include the permissions attribute in the manifest for the main JAR file are allowed to run with security prompts. All other applications are blocked. Unsigned applications could perform numerous types of attacks on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-000366Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-Add the key “deployment.security.level=VERY_HIGH” to the deployment.properties file. +-Add the key “deployment.security.level.locked” to the deployment.properties file.Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.security.level=VERY_HIGH” is not present in the deployment.properties file, or is set to “HIGH”, this is a finding. +- +-If the key “deployment.security.level.locked” is not present in the deployment.properties file, this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-UX-000070Oracle JRE 8 must be set to allow Java Web Start (JWS) applications.<VulnDiscussion>Java Web Start (JWS) applications are the most commonly used. Denying these applications could be detrimental to the user experience. Whitelisting, blacklisting, and signing of applications help mitigate the risk of running JWS applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-000366Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-Add the key “deployment.webjava.enabled=true” to the deployment.properties file. +- +-Add the key “deployment.webjava.enabled.locked” to the deployment.properties file.Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.webjava.enabled=true” is not present in the deployment.properties file, or is set to “false”, this is a finding. +- +-If the key “deployment.webjava.enabled.locked” is not present in the deployment.properties file, this is a finding.SRG-APP-000112<GroupDescription></GroupDescription>JRE8-UX-000080Oracle JRE 8 must disable the dialog enabling users to grant permissions to execute signed content from an untrusted authority.<VulnDiscussion>Java applets exist both signed and unsigned. Even for signed applets, there can be many sources, some of which may be purveyors of malware. Applet sources considered trusted can have their information populated into the browser, enabling Java to validate applets against trusted sources. Permitting execution of signed Java applets from untrusted sources may result in acquiring malware, and risks system modification, invasion of privacy, or denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-001695If the system is on the SIPRNet, this requirement is NA. +- +-Disable the “Allow user to grant permissions to content from an untrusted authority” feature. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-Add the key “deployment.security.askgrantdialog.notinca=false” to the deployment.properties file. +-Add the key “deployment.security.askgrantdialog.notinca.locked” to the deployment.properties file.If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the system-level “deployment.properties” file for Java. +- +- /etc/.java/deployment/deployment.properties +- +-If the key, “deployment.security.askgrantdialog.notinca=false” is not present, this is a finding. +- +-If the key, “deployment.security.askgrantdialog.notinca.locked” is not present, this is a finding. +- +-If the key “deployment.security.askgrantdialog.notinca” exists and is set to true, this is a finding.SRG-APP-000112<GroupDescription></GroupDescription>JRE8-UX-000090Oracle JRE 8 must lock the dialog enabling users to grant permissions to execute signed content from an untrusted authority.<VulnDiscussion>Java applets exist both signed and unsigned. Even for signed applets, there can be many sources, some of which may be purveyors of malware. Applet sources considered trusted can have their information populated into the browser, enabling Java to validate applets against trusted sources. Permitting execution of signed Java applets from untrusted sources may result in acquiring malware, and risks system modification, invasion of privacy, or denial of service. +- +-Ensuring users cannot change settings contributes to a more consistent security profile.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-001695If the system is on the SIPRNet, this requirement is NA. +- +-Lock the “Allow user to grant permissions to content from an untrusted authority” feature. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-Add the key “deployment.security.askgrantdialog.show=false” to the deployment.properties file. +-Add the key “deployment.security.askgrantdialog.show.locked” to the deployment.properties file.If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key, “deployment.security.askgrantdialog.show=false” is not present, this is a finding. +- +-If the key, “deployment.security.askgrantdialog.show.locked” is not present, this is a finding. +- +-If the key “deployment.security.askgrantdialog.show” exists and is set to true, this is a finding.SRG-APP-000175<GroupDescription></GroupDescription>JRE8-UX-000100Oracle JRE 8 must set the option to enable online certificate validation.<VulnDiscussion>Online certificate validation provides a real-time option to validate a certificate. When enabled, if a certificate is presented, the status of the certificate is requested. The status is sent back as “current”, “expired”, or “unknown”. Online certificate validation provides a greater degree of validation of certificates when running a signed Java applet. Permitting execution of an applet with an invalid certificate may result in malware, system modification, invasion of privacy, and denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-000185If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +-/etc/.java/deployment/deployment.properties +- +-Add the key “deployment.security.validation.ocsp=true” to the deployment.properties file. +- +-Add the key “deployment.security.validation.ocsp.locked” to the deployment.properties file.If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.security.validation.ocsp=true” is not present in the deployment.properties file, this is a finding. +- +-If the key “deployment.security.validation.ocsp.locked” is not present in the deployment.properties file, this is a finding. +- +-If the key “deployment.security.validation.ocsp” is set to “false”, this is a finding.SRG-APP-000209<GroupDescription></GroupDescription>JRE8-UX-000110Oracle JRE 8 must prevent the download of prohibited mobile code.<VulnDiscussion>Decisions regarding the employment of mobile code within organizational information systems are based on the potential for the code to cause damage to the system if used maliciously. +- +-Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient. +- +-Usage restrictions and implementation guidance apply to both the selection and use of mobile code installed, downloaded, or executed on all endpoints (e.g., servers, workstations, and smart phones). This requirement applies to applications that execute, evaluate, or otherwise process mobile code (e.g., web applications, browsers, and anti-virus applications).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-001169Navigate to the system-level “deployment.properties” file for JRE. +- +-/etc/.java/deployment/deployment.properties +- +-Add the key “deployment.security.blacklist.check=true” to the deployment.properties file. +- +-Add the key “deployment.security.blacklist.check.locked” to the deployment.properties file.Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.security.blacklist.check=true” is not present in the deployment.properties file, or is set to “false”, this is a finding. +- +-If the key “deployment.security.blacklist.check.locked” is not present in the deployment.properties file, this is a finding.SRG-APP-000386<GroupDescription></GroupDescription>JRE8-UX-000120Oracle JRE 8 must enable the option to use an accepted sites list.<VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. +- +-The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting. +- +-Verification of whitelisted software can occur either prior to execution or at system startup. +- +-This requirement applies to configuration management applications or similar types of applications designed to manage system processes and configurations (e.g., HBSS and software wrappers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-001774Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-Add the key “deployment.user.security.exception.sites=/etc/.java/deployment/exception.sites” to the deployment.properties file.Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.user.security.exception.sites” is not present in the deployment.properties file, this is a finding. +- +-If the key “deployment.user.security.exception.sites” is not set to the location of the exception.sites file, this is a finding. +- +-An example of a correct setting is: +-deployment.user.security.exception.sites=/etc/.java/deployment/exception.sitesSRG-APP-000386<GroupDescription></GroupDescription>JRE8-UX-000130Oracle JRE 8 must have an exception.sites file present.<VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. +- +-The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting. +- +-Verification of whitelisted software can occur either prior to execution or at system startup. +- +-This requirement applies to configuration management applications or similar types of applications designed to manage system processes and configurations (e.g., HBSS and software wrappers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-001774If the system is on the SIPRNet, this requirement is NA. +- +-Create the JRE exception.sites file: +- +-No default file exists. A text file named exception.sites, and the directory structure in which it is located must be manually created. The location must be aligned as defined in the deployment.properties file. +- +-/etc/.java/deployment/deployment.properties is an example.If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the “exception.sites” file for Java: +- +- /etc/.java/deployment/exception.sites +- +-If the exception.sites file does not exist, it must be created. The exception.sites file is a text file containing single-line URLs for accepted risk sites. If there are no AO approved sites to be added to the configuration, it is acceptable for this file to be blank. +- +-If the “exception.sites” file does not exist, this is a finding. +- +-If the “exception.sites” file contains URLs that are not AO approved, this is a finding.SRG-APP-000401<GroupDescription></GroupDescription>JRE8-UX-000150Oracle JRE 8 must enable the dialog to enable users to check publisher certificates for revocation.<VulnDiscussion>A certificate revocation list is a directory which contains a list of certificates that have been revoked for various reasons. Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found on a CRL should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-001991If the system is on the SIPRNet, this requirement is NA. +- +-Enable the “Check certificates for revocation using Certificate Revocation Lists (CRL)” option. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +-/etc/.java/deployment/deployment.properties +- +-Add the key “deployment.security.validation.crl=true” to the deployment.properties file. +- +-Add the key “deployment.security.validation.crl.locked” to the deployment.properties file.If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.security.validation.crl=true” is not present in the deployment.properties file, or is set to “false”, this is a finding. +- +-If the key “deployment.security.validation.crl.locked” is not present in the deployment.properties file, this is a finding.SRG-APP-000401<GroupDescription></GroupDescription>JRE8-UX-000160Oracle JRE 8 must lock the option to enable users to check publisher certificates for revocation.<VulnDiscussion>Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found revoked on a CRL or via Online Certificate Status Protocol (OCSP) should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service. +- +-Ensuring users cannot change these settings assures a more consistent security profile.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-001991If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +-/etc/.java/deployment/deployment.properties +- +-Add the key “deployment.security.revocation.check=ALL_CERTIFICATES” to the deployment.properties file. +- +-Add the key “deployment.security.revocation.check.locked” to the deployment.properties file.If the system is on the SIPRNet, this requirement is NA. +- +-Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.security.revocation.check=ALL_CERTIFICATES” is not present, or is set to “PUBLISHER_ONLY”, or “NO_CHECK”, this is a finding. +- +-If the key “deployment.security.revocation.check.locked” is not present, this is a finding.SRG-APP-000488<GroupDescription></GroupDescription>JRE8-UX-000170Oracle JRE 8 must prompt the user for action prior to executing mobile code.<VulnDiscussion>Mobile code can cause damage to the system. It can execute without explicit action from, or notification to, a user. +- +-Actions enforced before executing mobile code include, for example, prompting users prior to opening email attachments and disabling automatic execution. +- +-This requirement applies to mobile code-enabled software, which is capable of executing one or more types of mobile code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-002460Navigate to the system-level “deployment.properties” file for JRE. +- +-/etc/.java/deployment/deployment.properties +- +-Add the key “deployment.insecure.jres=PROMPT” to the deployment.properties file. +- +-Add the key “deployment.insecure.jres.locked” to the deployment.properties file.Navigate to the system-level “deployment.properties” file for JRE. +- +- /etc/.java/deployment/deployment.properties +- +-If the key “deployment.insecure.jres=PROMPT” is not present in the deployment.properties file, this is a finding. +- +-If the key “deployment.insecure.jres.locked” is not present in the deployment.properties file, this is a finding. +- +-If the key “deployment.insecure.jres” is set to “NEVER”, this is a finding.SRG-APP-000454<GroupDescription></GroupDescription>JRE8-UX-000190Oracle JRE 8 must remove previous versions when the latest version is installed.<VulnDiscussion>Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-002617Remove previous versions of JRE. +- +-RPM uninstall: +-# rpm -e jre-<version>-fcs +- +-Self-extracting file uninstall: +-# rm -r jre<version> +- +-Perform for all out of date instances of JRE.Review the system configuration to ensure old versions of JRE have been removed. +- +-There are two ways to uninstall Java. Use the method that you used when you installed Java. For example, if you used RPM to install Java, then use the RPM uninstall method. +- +-If RPM is installed, first query to ascertain that JRE was installed using RPM. +- +-Search for the JRE package by typing: +-# rpm -qa | grep -i jre +- +-If RPM reports a package similar to jre-<version>-fcs, then JRE is installed with RPM. If JRE is not installed using RPM, skip to "Self-extracting file uninstall". +- +-To uninstall Java via RPM, type: +-# rpm -e jre-<version>-fcs +- +-Self-extracting file uninstall: +-1. Browse folders to ascertain where JRE is installed. Common locations are /usr/java/jre_<version> or opt/jre_nb/jre_<version>/bin/java/ +-2. When you have located the directory, you may delete the directory by using the following command: +-Note: Ensure JRE is not already installed using RPM before removing the directory. +-# rm -r /<path to jre>/jre<version> +- +-Ensure only one instance of JRE is installed on the system. +- +-# ps -ef | grep -I jre +- +-If more than one instance of JRE is running, this is a finding.SRG-APP-000456<GroupDescription></GroupDescription>JRE8-UX-000180The version of Oracle JRE 8 running on the system must be the most current available.<VulnDiscussion>Oracle JRE 8 is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the JRE can introduce security vulnerabilities to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target JRE 8 (1.8)DISADPMS TargetJRE 8 (1.8)3045CCI-002605Test applications to ensure operational compatibility with new version of Java. +- +-Install latest version of Oracle JRE 8.Open a terminal window and type the command: +-"java -version" sans quotes. +- +-The return value should contain Java build information: +- +-"Java (TM) SE Runtime Environment (build x.x.x.x)" +- +-Cross reference the build information on the system with the Oracle Java site to identify the most recent build available. +- +-If the version of Oracle JRE 8 running on the system is out of date, this is a finding. +\ No newline at end of file +diff --git a/shared/references/disa-stig-jre8-unix-v2r1-xccdf-manual.xml b/shared/references/disa-stig-jre8-unix-v2r1-xccdf-manual.xml +new file mode 100644 +index 00000000000..00186f35657 +--- /dev/null ++++ b/shared/references/disa-stig-jre8-unix-v2r1-xccdf-manual.xml +@@ -0,0 +1,272 @@ ++acceptedOracle Java Runtime Environment (JRE) Version 8 for Windows Security Technical Implementation GuideThis Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.DISASTIG.DOD.MILRelease: 1 Benchmark Date: 22 Jan 20213.2.1.416661.10.02I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-APP-000516<GroupDescription></GroupDescription>JRE8-WN-000010Oracle JRE 8 must have a deployment.config file present.<VulnDiscussion>By default no deployment.config file exists; thus, no system-wide deployment.properties file exists. The file must be created. The deployment.config file is used for specifying the location and execution of system-level properties for the Java Runtime Environment. Without the deployment.config file, setting particular options for the Java control panel is impossible. ++ ++The deployment.config file can be created in either of the following locations: ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.config ++- or - ++<JRE Installation Directory>\lib\deployment.config</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66939SV-81429CCI-000366By default, no "deployment.config" file exists; a text file must be created. Create a JRE deployment configuration file in either: ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.config ++- or - ++<JRE Installation Directory>\Lib\deployment.configBy default, no "deployment.config" file exists; it must be created. Verify a "deployment.config" configuration file exists in either: ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.config ++- or - ++<JRE Installation Directory>\Lib\deployment.config ++ ++If the "deployment.config" configuration file does not exist in either of these folders, this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-WN-000020Oracle JRE 8 deployment.config file must contain proper keys and values.<VulnDiscussion>The deployment.config configuration file contains two keys. ++ ++The "deployment.properties" key includes the path of the "deployment.properties" file and the "deployment.properties.mandatory" key contains either a TRUE or FALSE value. ++ ++If the path specified to "deployment.properties" does not lead to a "deployment.properties" file, the value of the “deployment.system.config.mandatory” key determines how JRE will handle the situation. ++ ++If the value of the "deployment.system.config.mandatory" key is TRUE and if the path to the "deployment.properties" file is invalid, the JRE will not allow Java applications to run. This is the desired behavior.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66941SV-81431CCI-000366Navigate to the "deployment.config" file for JRE. ++ ++Add the key "deployment.system.config=<Path to deployment.properties>" to the "deployment.config" file. The following is an example: ++"deployment.system.config=file:///C:/Windows/Java/Deployment/deployment.properties". Note the use of forward slashes. ++ ++Add the key "deployment.system.config.mandatory=true" to the "deployment.config" file.Navigate to the "deployment.config" file for Java: ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.config ++- or - ++<JRE Installation Directory>\Lib\deployment.config ++ ++The "deployment.config" file contains two properties: deployment.system.config and deployment.system.config.mandatory. ++ ++The "deployment.system.config" key points to the location of the "deployment.properties" file. The location is variable. It can point to a file on the local disk or a UNC path. The following is an example: ++"deployment.system.config=file:///C:/Windows/Java/Deployment/deployment.properties" ++ ++If the "deployment.system.config" key does not exist or does not point to the location of the "deployment.properties" file, this is a finding. ++ ++If the "deployment.system.config.mandatory" key does not exist or is set to "false", this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-WN-000030Oracle JRE 8 must have a deployment.properties file present.<VulnDiscussion>By default no deployment.properties file exists; thus, no system-wide deployment exists. The file must be created. The deployment.properties file is used for specifying keys for the Java Runtime Environment. Each option in the Java control panel is represented by property keys. These keys adjust the options in the Java control panel based on the value assigned to that key. Without the deployment.properties file, setting particular options for the Java control panel is impossible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66943SV-81433CCI-000366Create the JRE "deployment.properties" file: ++ ++No default file exists. A text file named "deployment.properties", and the directory structure in which it is located, must be manually created. ++The location must be aligned as defined in the "deployment.config" file. ++ ++C:\Windows\Java\Deployment\deployment.properties is an example.Navigate to the system-level "deployment.properties" file for JRE. ++ ++The location of the "deployment.properties" file is defined in the "deployment.config" file. ++ ++If there are no files titled "deployment.properties", this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-WN-000060Oracle JRE 8 must default to the most secure built-in setting.<VulnDiscussion>Applications that are signed with a valid certificate and include the permissions attribute in the manifest for the main JAR file are allowed to run with security prompts. All other applications are blocked. Unsigned applications could perform numerous types of attacks on a system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66945SV-81435CCI-000366Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.security.level=VERY_HIGH" to the "deployment.properties" file. ++ ++Add the key "deployment.security.level.locked" to the "deployment.properties" file.Navigate to the system-level "deployment.properties" file for JRE. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.security.level=VERY_HIGH" is not present in the "deployment.properties file", or is set to "HIGH", this is a finding. ++ ++If the key "deployment.security.level.locked" is not present in the "deployment.properties" file, this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-WN-000070Oracle JRE 8 must be set to allow Java Web Start (JWS) applications.<VulnDiscussion>Java Web Start (JWS) applications are the most commonly used. Denying these applications could be detrimental to the user experience. Whitelisting, blacklisting, and signing of applications help mitigate the risk of running JWS applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66947SV-81437CCI-000366Navigate to the system-level “deployment.properties” file for JRE. ++ ++The location of the deployment.properties file is defined in <JRE Installation Directory>\Lib\deployment.config ++ ++Add the key “deployment.webjava.enabled=true” to the deployment.properties file. ++ ++Add the key “deployment.webjava.enabled.locked” to the deployment.properties file. ++ ++Note: If JWS is not enabled, this requirement is NA.Navigate to the system-level “deployment.properties” file for JRE. ++ ++The location of the deployment.properties file is defined in <JRE Installation Directory>\Lib\deployment.config ++ ++If the key “deployment.webjava.enabled=true” is not present in the deployment.properties file, or is set to “false”, this is a finding. ++ ++If the key “deployment.webjava.enabled.locked” is not present in the deployment.properties file, this is a finding. ++ ++Note: If JWS is not enabled, this requirement is NA.SRG-APP-000112<GroupDescription></GroupDescription>JRE8-WN-000080Oracle JRE 8 must disable the dialog enabling users to grant permissions to execute signed content from an untrusted authority.<VulnDiscussion>Java applets exist both signed and unsigned. Even for signed applets, there can be many sources, some of which may be purveyors of malware. Applet sources considered trusted can have their information populated into the browser, enabling Java to validate applets against trusted sources. Permitting execution of signed Java applets from untrusted sources may result in acquiring malware, and risks system modification, invasion of privacy, or denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66949SV-81439CCI-001695If the system is on the SIPRNet, this requirement is NA. ++ ++Disable the "Allow user to grant permissions to content from an untrusted authority" feature. ++ ++Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.security.askgrantdialog.notinca=false" to the "deployment.properties" file. ++ ++Add the key "deployment.security.askgrantdialog.notinca.locked" to the "deployment.properties" file.If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the system-level "deployment.properties" file for Java. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.security.askgrantdialog.notinca=false" is not present, this is a finding. ++ ++If the key "deployment.security.askgrantdialog.notinca.locked" is not present, this is a finding. ++ ++If the key "deployment.security.askgrantdialog.notinca" exists and is set to "true", this is a finding.SRG-APP-000112<GroupDescription></GroupDescription>JRE8-WN-000090Oracle JRE 8 must lock the dialog enabling users to grant permissions to execute signed content from an untrusted authority.<VulnDiscussion>Java applets exist both signed and unsigned. Even for signed applets, there can be many sources, some of which may be purveyors of malware. Applet sources considered trusted can have their information populated into the browser, enabling Java to validate applets against trusted sources. Permitting execution of signed Java applets from untrusted sources may result in acquiring malware, and risks system modification, invasion of privacy, or denial of service. ++ ++Ensuring users cannot change settings contributes to a more consistent security profile.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66951SV-81441CCI-001695If the system is on the SIPRNet, this requirement is NA. ++ ++Lock the "Allow user to grant permissions to content from an untrusted authority" feature. ++ ++Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.security.askgrantdialog.show=false" to the "deployment.properties" file. ++ ++Add the key "deployment.security.askgrantdialog.show.locked" to the "deployment.properties" file.If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the system-level "deployment.properties" file for JRE. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.security.askgrantdialog.show=false" is not present, this is a finding. ++ ++If the key "deployment.security.askgrantdialog.show.locked" is not present, this is a finding. ++ ++If the key "deployment.security.askgrantdialog.show" exists and is set to "true", this is a finding.SRG-APP-000175<GroupDescription></GroupDescription>JRE8-WN-000100Oracle JRE 8 must set the option to enable online certificate validation.<VulnDiscussion>Online certificate validation provides a real-time option to validate a certificate. When enabled, if a certificate is presented, the status of the certificate is requested. The status is sent back as “current”, “expired”, or “unknown”. Online certificate validation provides a greater degree of validation of certificates when running a signed Java applet. Permitting execution of an applet with an invalid certificate may result in malware, system modification, invasion of privacy, and denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66953SV-81443CCI-000185If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.security.validation.ocsp=true" to the "deployment.properties" file. ++ ++Add the key "deployment.security.validation.ocsp.locked" to the "deployment.properties" file.If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the system-level "deployment.properties" file for JRE. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.security.validation.ocsp=true" is not present in the "deployment.properties" file, this is a finding. ++ ++If the key "deployment.security.validation.ocsp.locked" is not present in the "deployment.properties" file, this is a finding. ++ ++If the key "deployment.security.validation.ocsp" is set to "false", this is a finding.SRG-APP-000209<GroupDescription></GroupDescription>JRE8-WN-000110Oracle JRE 8 must prevent the download of prohibited mobile code.<VulnDiscussion>Decisions regarding the employment of mobile code within organizational information systems are based on the potential for the code to cause damage to the system if used maliciously. ++ ++Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient. ++ ++Usage restrictions and implementation guidance apply to both the selection and use of mobile code installed, downloaded, or executed on all endpoints (e.g., servers, workstations, and smart phones). This requirement applies to applications that execute, evaluate, or otherwise process mobile code (e.g., web applications, browsers, and anti-virus applications).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66955SV-81445CCI-001169Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.security.blacklist.check=true" to the "deployment.properties" file. ++ ++Add the key "deployment.security.blacklist.check.locked" to the "deployment.properties" file.Navigate to the system-level "deployment.properties" file for JRE. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.security.blacklist.check=true" is not present in the "deployment.properties" file, or is set to "false", this is a finding. ++ ++If the key "deployment.security.blacklist.check.locked" is not present in the "deployment.properties" file, this is a finding.SRG-APP-000386<GroupDescription></GroupDescription>JRE8-WN-000120Oracle JRE 8 must enable the option to use an accepted sites list.<VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. ++ ++The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting. ++ ++Verification of whitelisted software can occur either prior to execution or at system startup. ++ ++This requirement applies to configuration management applications or similar types of applications designed to manage system processes and configurations (e.g., HBSS and software wrappers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66957SV-81447CCI-001774Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.user.security.exception.sites=C\:\\Windows\\Sun\\Java\\Deployment\\exception.sites" to the "deployment.properties" file.Navigate to the system-level "deployment.properties" file for JRE. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.user.security.exception.sites" is not present in the "deployment.properties" file, this is a finding. ++ ++If the key "deployment.user.security.exception.sites" is not set to the location of the "exception.sites" file, this is a finding. ++ ++An example of a correct setting is: ++deployment.user.security.exception.sites=C\:\\Windows\\Sun\\Java\\Deployment\\exception.sitesSRG-APP-000386<GroupDescription></GroupDescription>JRE8-WN-000130Oracle JRE 8 must have an exception.sites file present.<VulnDiscussion>Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. ++ ++The organization must identify authorized software programs and permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting. ++ ++Verification of whitelisted software can occur either prior to execution or at system startup. ++ ++This requirement applies to configuration management applications or similar types of applications designed to manage system processes and configurations (e.g., HBSS and software wrappers).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66959SV-81449CCI-001774If the system is on the SIPRNet, this requirement is NA. ++ ++Create the JRE exception.sites file: ++No default file exists. A text file named exception.sites, and the directory structure in which it is located must be manually created. The location must be aligned as defined in the deployment.properties file. ++C:\Windows\Java\Deployment\deployment.properties is an example.If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the “exception.sites” file for Java: ++ ++The location of the "exception.sites" file is defined in the deployment.properties file. ++ ++The "exception.sites" file is a text file containing single-line URLs for accepted risk sites. If there are no AO approved sites to be added to the configuration, it is acceptable for this file to be blank. ++ ++If the “exception.sites” file does not exist, this is a finding. ++ ++If the “exception.sites” file contains URLs that are not AO approved, this is a finding. ++ ++Note: DeploymentRuleSet.jar is an acceptable substitute for using exception.sites. Interview the SA to view contents of the "DeploymentRuleSet.jar" file to ensure any AO approved sites are whitelisted.SRG-APP-000401<GroupDescription></GroupDescription>JRE8-WN-000150Oracle JRE 8 must enable the dialog to enable users to check publisher certificates for revocation.<VulnDiscussion>A certificate revocation list is a directory which contains a list of certificates that have been revoked for various reasons. Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found on a CRL should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66961SV-81451CCI-001991If the system is on the SIPRNet, this requirement is NA. ++ ++Enable the "Check certificates for revocation using If the system is on the SIPRNet, this requirement is NA. ++ ++Enable the "Check certificates for revocation using Certificate Revocation Lists (CRL)" option. ++ ++Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.security.validation.crl=true" to the "deployment.properties" file. ++ ++Add the key "deployment.security.validation.crl.locked" to the "deployment.properties" file.If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the system-level "deployment.properties" file for JRE. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.security.validation.crl=true" is not present in the "deployment.properties" file, or is set to "false", this is a finding. ++ ++If the key "deployment.security.validation.crl.locked" is not present in the "deployment.properties" file, this is a finding.SRG-APP-000516<GroupDescription></GroupDescription>JRE8-WN-000160Oracle JRE 8 must lock the option to enable users to check publisher certificates for revocation.<VulnDiscussion>Certificates may be revoked due to improper issuance, compromise of the certificate, and failure to adhere to policy. Therefore, any certificate found revoked on a CRL or via Online Certificate Status Protocol (OCSP) should not be trusted. Permitting execution of an applet published with a revoked certificate may result in spoofing, malware, system modification, invasion of privacy, and denial of service. ++ ++Ensuring users cannot change these settings assures a more consistent security profile.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66723SV-81213CCI-001991If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the system-level “deployment.properties” file for JRE. ++ ++The location of the deployment.properties file is defined in <JRE Installation Directory>\Lib\deployment.config ++ ++Add the key “deployment.security.revocation.check=ALL_CERTIFICATES” to the deployment.properties file. ++ ++Add the key “deployment.security.revocation.check.locked” to the deployment.properties file.If the system is on the SIPRNet, this requirement is NA. ++ ++Navigate to the system-level “deployment.properties” file for JRE. ++ ++The location of the deployment.properties file is defined in <JRE Installation Directory>\Lib\deployment.config ++ ++If the key “deployment.security.revocation.check=ALL_CERTIFICATES” is not present, or is set to “PUBLISHER_ONLY”, or “NO_CHECK”, this is a finding. ++ ++If the key “deployment.security.revocation.check.locked” is not present, this is a finding.SRG-APP-000488<GroupDescription></GroupDescription>JRE8-WN-000170Oracle JRE 8 must prompt the user for action prior to executing mobile code.<VulnDiscussion>Mobile code can cause damage to the system. It can execute without explicit action from, or notification to, a user. ++ ++Actions enforced before executing mobile code include, for example, prompting users prior to opening email attachments and disabling automatic execution. ++ ++This requirement applies to mobile code-enabled software, which is capable of executing one or more types of mobile code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66963SV-81453CCI-002460Navigate to the system-level "deployment.properties" file for JRE. ++ ++Add the key "deployment.insecure.jres=PROMPT" to the "deployment.properties" file. ++ ++Add the key "deployment.insecure.jres.locked" to the "deployment.properties" file.Navigate to the system-level "deployment.properties" file for JRE. ++ ++<Windows Directory>\Sun\Java\Deployment\deployment.properties ++- or - ++<JRE Installation Directory>\Lib\deployment.properties ++ ++If the key "deployment.insecure.jres=PROMPT" is not present in the "deployment.properties" file, this is a finding. ++ ++If the key "deployment.insecure.jres.locked" is not present in the "deployment.properties" file, this is a finding. ++ ++If the key "deployment.insecure.jres" is set to "NEVER", this is a finding.SRG-APP-000456<GroupDescription></GroupDescription>JRE8-WN-000180The version of Oracle JRE 8 running on the system must be the most current available.<VulnDiscussion>Oracle JRE 8 is being continually updated by the vendor in order to address identified security vulnerabilities. Running an older version of the JRE can introduce security vulnerabilities to the system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271SV-81457V-66967CCI-002605Test applications to ensure operational compatibility with new version of Java. ++ ++Install a supported version of Oracle JRE 8.Open a terminal window and type the command: ++"java -version" sans quotes. ++ ++The return value should contain Java build information: ++ ++"Java (TM) SE Runtime Environment (build x.x.x.x)" ++ ++Cross-reference the build information on the system with the Oracle Java site to verify the version is supported by the vendor. ++ ++If the version of Oracle JRE 8 running on the system is unsupported, this is a finding.SRG-APP-000454<GroupDescription></GroupDescription>JRE8-WN-000190Oracle JRE 8 must remove previous versions when the latest version is installed.<VulnDiscussion>Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target Oracle Java Runtime Environment v8 for WindowsDISADPMS TargetOracle Java Runtime Environment v8 for Windows5271V-66965SV-81455CCI-002617Remove previous versions of JRE. ++ ++Open the Windows Control Panel, and navigate to "Programs and Features". ++ ++Highlight, and click uninstall on all out of date instances of JRE.Review the system configuration to ensure old versions of JRE have been removed. ++ ++Open the Windows Control Panel, and navigate to "Programs and Features". ++ ++Ensure only one instance of JRE is in the list of installed software. If more than one instance of JRE is listed, this is a finding. ++ ++Note: A 32 and 64 bit version of the same instance is acceptable. +\ No newline at end of file + +From 9bfe365a1fec19b62e785d96e6146e50224809d7 Mon Sep 17 00:00:00 2001 +From: Gabriel Becker +Date: Mon, 26 Jul 2021 18:14:24 +0200 +Subject: [PATCH 08/10] Update DISA STIG Chrome manual benchmark file. + +--- + .../disa-google-chrome-browser-v1r2-stig.xml | 1736 ----------------- + .../disa-google-chrome-browser-v2r3-stig.xml | 589 ++++++ + 2 files changed, 589 insertions(+), 1736 deletions(-) + delete mode 100644 shared/references/disa-google-chrome-browser-v1r2-stig.xml + create mode 100644 shared/references/disa-google-chrome-browser-v2r3-stig.xml + +diff --git a/shared/references/disa-google-chrome-browser-v1r2-stig.xml b/shared/references/disa-google-chrome-browser-v1r2-stig.xml +deleted file mode 100644 +index 1235715fd04..00000000000 +--- a/shared/references/disa-google-chrome-browser-v1r2-stig.xml ++++ /dev/null +@@ -1,1736 +0,0 @@ +- +- accepted +- Google Chrome Current Windows STIG +- +- +- DISA, Field Security Operations +- STIG.DOD.MIL +- +- Release: 1 Benchmark Date: 03 Mar 2014 +- 1 +- +- I - Mission Critial Classified +- <ProfileDescription></ProfileDescription> +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- I - Mission Critial Sensitive +- <ProfileDescription></ProfileDescription> +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- II - Mission Support Public +- <ProfileDescription></ProfileDescription> +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- III - Administrative Classified +- <ProfileDescription></ProfileDescription> +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- III - Administrative Sensitive +- <ProfileDescription></ProfileDescription> +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +- +-